The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Bro Tunnel TQL queries

Published on Sep 9, 2026

1 minute(s) read

Prev Next

The following TQL query is a Bro tunnel query.

Identify connections being tunneled through a SOCKS proxy

class:bro_tunnels !dstisp:"private ip address lan" !dstisp:"<target corporation>" metaclass:connection category:tunnel::socks | groupby [srcipv4,dstipv4]

Was this article helpful?