Skip to main content
Phung_Ong
Phung_Ong
Explorer
November 3, 2022
Solved

Understand High risk app usage trigger - FortiAnalyser

  • November 3, 2022
  • 1 reply
  • 2686 views

Hi Everyone,

please help me to understand this, 

when I checked the Event monitor by threat (High Risk App Usage), I found out that the application: TOR is using by some computers in company, actually the tor is not installed on any computers, please let me know why Fortianalyser show that? how we can investigate?

Thanks

 

Phung_Ong_1-1667450097005.png

Best answer by gfleming

Tor is a protocol. Like BitTorrent, or IRC, etc. Tor is used to anonymize user traffic.

 

https://www.torproject.org/

 

It is considered high risk for a few reasons: 

1. it can be used to bypass firewall filters (traffic to blocked sites can be accessed through Tor)

2. It is used to access the "dark web"

3. It can put undue stress on your network and if users are somehow running relays or exit nodes on your network can put you on blacklists

 

Just like other protocols, you can access these "apps" through web browsers. So just like IRC, or WhatsApp, etc. I don't always need a dedicated app to access these things. A web browser works just the same. And FGT App Control will flag the access to these apps regardless of how they are accessed.

 

You can investigate by figuring out which devices are accessing the Tor network by looking at FAZ logs. You can also put an app control policy in place to block it if you feel it is required to do so.

1 reply

gfleming
Staff
gflemingAnswer
Staff
November 3, 2022

Tor is a protocol. Like BitTorrent, or IRC, etc. Tor is used to anonymize user traffic.

 

https://www.torproject.org/

 

It is considered high risk for a few reasons: 

1. it can be used to bypass firewall filters (traffic to blocked sites can be accessed through Tor)

2. It is used to access the "dark web"

3. It can put undue stress on your network and if users are somehow running relays or exit nodes on your network can put you on blacklists

 

Just like other protocols, you can access these "apps" through web browsers. So just like IRC, or WhatsApp, etc. I don't always need a dedicated app to access these things. A web browser works just the same. And FGT App Control will flag the access to these apps regardless of how they are accessed.

 

You can investigate by figuring out which devices are accessing the Tor network by looking at FAZ logs. You can also put an app control policy in place to block it if you feel it is required to do so.

    Terms & ConditionsAccessibility statement