Need a complete list of TOR IP's which are being used in GCTI

You are running into the 50 row limit here.  According to the Google Security Operations documentation on Conduct entity context searches, specifically the Limitations section:

• "Global context data: There's a limit of 50 rows for sensitive global context data, such as UPPERCASE_VT_PROTECTED, MANDIANT_ACTIVE_BREACH_IOC, MANDIANT_FUSION_IOC, and VIRUS_TOTAL_CONNECTIONS."

This post here may help you, but as Kent pointed out, we don't allow customers to pull this entire list from SecOps, there is a limit in the platform that we will only show you 50. 

 

Hi ​@kentphelps 
Thnaks for the reply, i too undetstand that there is a hard limit of 50 rows for global context data.
My question is there any other way we can get a complete list of TOR IP. One of my client is looking for that data as they need it for some other enrichment purpose.

The list is dynamic so there is no way to pull a static list but rather just get the current snapshot.  What is the use case here?  There is a way via the SecOps CLI if that is already installed and authenticated.

bash

SECOPS_QUERY='metadata.event_type = "NETWORK_CONNECTION" AND graph.metadata.threat.threat_feed_name = "Tor Exit Nodes"'

secops search \
--query "${SECOPS_QUERY}" \
--fields "metadata.event_timestamp, principal.ip, target.ip, target.port, graph.entity.artifact.ip"\

--time-window "30d" \
--csv > tor_exit_node_events.csv

An alternative source would be TOR Node List