About
DigiAsh.
DigiAsh queries nine threat-intelligence sources with a single search and presents the results together, so the evidence for an investigation or a report is available in one place.
The name
A combination of English and Japanese.
IP addresses, domains and files leave digital footprints: abuse reports, sandbox analyses, scan results and blocklist entries. DigiAsh gathers these records from nine sources and presents them side by side.
Two reasons it was built
Professional development, and efficiency in day-to-day work.
To understand the full lifecycle
DigiAsh began as a way to understand everything involved in taking a web application from concept to production: the design, the code, and the infrastructure configuration behind it.
Security was treated as a design requirement throughout rather than a final step, so every feature was planned, built and reviewed with its security implications considered from the outset.
To reduce context switching
I use the tools DigiAsh connects to throughout my working day. Checking a single indicator meant opening a separate tab for each one, which adds up, particularly when gathering reputational evidence for reports.
DigiAsh queries them simultaneously, summarises the relevant findings and links back to each source.
The trade-off
An initial setup, followed by time saved on every search.
Initial setup
- Create an account and enable two-factor authentication.
- Sign up for each threat-intel tool you want to use.
- Generate an API key in each one and store it in DigiAsh, where it is encrypted.
Results in one place
- One search queries every source you've connected.
- One risk score, the key signals, and each source's detail.
- Every finding links back to its source, ready to cite as evidence.
Registering with each provider and storing the API keys takes some time. It is a one-off task: afterwards, lookups that would otherwise span several tabs require a single search.
Who it's for
Anyone who checks indicators as part of their work, and anyone learning to.
Triage an alert in one search
Check the IP address or domain behind an alert across every connected source, then paste the evidence links straight into the ticket.
Follow the infrastructure
Pivot from one indicator to the domains hosted alongside it and the addresses it has resolved to, one click at a time.
Check files and brief stakeholders
Look up a file hash against sandbox and malware feeds, then hand managers a one-page Executive Brief with a clear verdict.
Learn how the evidence fits together
See what each source reports for the same indicator, and how the "Why this score" breakdown turns those findings into one risk score.
Security
The controls protecting accounts and stored keys. The Security Policy describes them in full.
Encrypted API keys
Each account's API keys are encrypted with AES-256-GCM and are not displayed again after saving.
Two-factor authentication
TOTP with any authenticator app. Each code works once, and repeated wrong codes lock the account temporarily.
Session control
Sessions end after a password reset or a change to two-factor settings, and other devices can be signed out at any time.
Password policy
Length and complexity rules, a check against known breached passwords, password history and expiry.
Rate limits and bot checks
Per-address and per-account limits on sign-in and searches, and a human check on signup, password resets and the contact form.
Hardened pages
A strict Content Security Policy, security headers, and all provider responses treated as untrusted input.
How it was built
In five phases, each building on the last, on a deliberately small stack.
One search, many sources
A Cloudflare Worker queries every provider at the same time and reads each answer defensively, treating everything that comes back as untrusted input.
Accounts and your own keys
Accounts, two-factor authentication, and API keys encrypted per account, so every user brings their own keys and nothing is shared or pooled.
A score you can explain
A risk model that combines evidence instead of averaging it, with a confidence level and a breakdown of which sources drove each score.
Hardening
Rate limits, bot checks, email verification, a password policy and a strict Content Security Policy, checked against a pre-launch security checklist.
Built for real investigations
Shareable reports, defanged input, one-click pivoting and search history, refined through user acceptance testing.
Built by DungeonXplorer
An ICT Security Analyst working in security operations, information security and strategy, who uses these tools daily.
Get started
Create a free account, connect the sources you already use and run your first search.