I'm looking for a possible way to identify Tor Browser activity using QRadar. We have Firewall integrated & IPS (Without Application Control. Hence not a possible option). I went through the link https://www.dan.me.uk/tornodes but not able to synchronize the link all the time with QRadar.
Do you have any recommendation to detect the Tor Browser activity in an environment using Firewall logs integrated in QRadar? I don't have access to the firewall. So can't make any changes in firewall. I can only make changes in QRadar.
As Tor uses port 443, 9001 & 9030, is there a way to synchronize the content of the URL https://www.dan.me.uk/tornodes or any other way to detect Tor Browser activity in the network.
I don't want to block. I only want to detect using QRadar.