Press CTRL+K to open search

Bro Tunnel TQL queries

  • Published on Sep 9, 2026
  • 1 minute(s) read
Prev Next

The following TQL query is a Bro tunnel query.

Identify connections being tunneled through a SOCKS proxy
class:bro_tunnels !dstisp:"private ip address lan" !dstisp:"<target corporation>" metaclass:connection category:tunnel::socks | groupby [srcipv4,dstipv4]
    Related articles
    • Bro SSH TQL queries
      Helix Enterprise > Helix Enterprise TQL Reference Guide Release 2023.1 > TQL cheatsheet and use cases > Bro-specific TQL queries
    • Bro Conn TQL queries
      Helix Enterprise > Helix Enterprise TQL Reference Guide Release 2023.1 > TQL cheatsheet and use cases > Bro-specific TQL queries
    • Bro HTTP TQL queries
      Helix Enterprise > Helix Enterprise TQL Reference Guide Release 2023.1 > TQL cheatsheet and use cases > Bro-specific TQL queries
    Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy.
    Products
    Company
    Top Features
    Solutions
    Existing Users
    Connect With Us
    Sales and Support
    Copyright © Abc Inc. All Rights Reserved