Sonar documentation

Sonar organizes authorized infrastructure into workspaces. Each domain or public IP becomes its own workspace with its own scans, findings, members and webhook. Your account holds every workspace you belong to; workspaces can be renamed, merged, or deleted at any time, and a domain counts as a single asset no matter how many subdomains are observed beneath it.

Add and verify an asset

1. Sign in with Discord or Google. New accounts start in account mode; open Workspaces.
2. Name the workspace and paste one or more domains or public IPs — one per line. Each becomes an asset in the new workspace.
3. For domains, publish the displayed TXT value at the displayed challenge name. For IPs, serve the challenge at the displayed HTTP URL without a redirect.
4. Select Verify ownership for each asset. Once verified, the challenge is hidden — the card keeps a Remove action only. Scans recheck ownership every run, so leave records in place.
5. Add more assets at any time from the workspace's asset panel, and set a scan schedule on the Scans page.

How a run works

One run covers every verified asset in the workspace and consumes one unit of the workspace's daily run allowance (resetting at midnight UTC). Each asset passes through:

• Discovery — subdomains from certificate transparency feeds, the live certificate's SANs, public web archives, additional public subdomain feeds and a curated name list (resolver-side only).
• Ports — a paced TCP connect sweep across your chosen coverage (common, extended or full), a low-intensity version fingerprint pass on open ports, and single UDP probes to DNS, NTP and SNMP.
• Web — HTTP(S) analysis, TLS certificate and cipher analysis, security-header and version-disclosure review, technology fingerprinting, favicon fingerprinting, and one latest screenshot of the web surface.
• DNS & mail — SPF, DMARC, CAA and DNSSEC hygiene, plus deeper mail-security checks for MTA-STS, TLS-RPT, BIMI and DKIM selectors.
• Exposure — read-only checks for accidentally published files, a signature template engine (additional exposure and login/admin-panel and API-surface detection), and secret-pattern scanning of the page and its own same-origin scripts.
• Change & takeover — subdomain-takeover confirmation against the hosting provider's own response, and per-change alerts summarizing opened and closed ports since the last observation.

A safe activity log records each milestone; open View log on any scan.

Organize your inventory

Tag assets with lowercase labels to group them, and filter by tag:. Every asset carries a lifecycle state — new, active, changed or decommissioned; the worker marks discovered hosts "new" and flips a settled asset to "changed" when its fingerprint moves, and decommissioning also removes it from scanning. Star assets to build a personal watchlist, save any asset search as a named view, and use the command palette (⌘K / Ctrl-K) to jump between views or run a search from anywhere.

Risk, priority and SLAs

Every asset carries a 0–100 posture score and letter grade derived from its open findings, and the workspace Overview shows the daily score trend. Each finding also gets a priority (0–100) computed from its severity, whether the CVE is on the CISA Known Exploited Vulnerabilities list, its FIRST EPSS exploit-probability, and the asset's business criticality — the findings queue sorts by priority by default. Severity-based remediation SLAs mark overdue findings. KEV and EPSS data come from free public feeds and refresh in the background.

Findings workflow

Assign a finding to a teammate (they are notified directly), change the status of many findings at once, and @mention members in comments. Suppression rules keep known-accepted findings out of the open queue — a matching finding is recorded as a false positive now and on every future scan instead of reopening. Re-test an asset on demand to queue a fresh scan of its scope. An activity feed records assignments, status changes, comments, re-tests and detected changes. Each member chooses which notification categories they receive.

Investigate

Asset search matches hostnames and collected evidence. Select an asset to open its drawer: a header with tags, lifecycle, a watch toggle and a re-test button, then tabs for Overview (evidence, technology stack, services, UDP, screenshot, activity and history), Findings, and Advanced (software inventory and authenticated read-only checks). Findings include severity, priority, KEV/EPSS intelligence, evidence and remediation. Resolved findings reopen if observed again, unless suppressed.

Search syntax

Combine terms with spaces to require every condition. Supported fields: host, ip, port, udp, http.status, cert.issuer, service, tech, severity, excluded, tag, lifecycle, watched and favicon. Quote phrases containing spaces. Ports, IPs and favicon hashes match exactly; hostnames, service fingerprints, technologies and issuers use text matching. Severity matches open findings.

port:443 http.status:200 cert.issuer:"Example Authority"
tech:nginx severity:high
tag:production lifecycle:new watched:true
udp:161 host:api excluded:false

Attribution discovery

From Company → Discovery, find candidate domains that mention a brand label in public certificate transparency, and mobile apps from the public App Store. Results are candidates for review only — nothing is added to scope or scanned, and ownership must still be verified before an asset is added.

Public passive search — the Tohou Index

Public record search is its own product at search.tohou.io, signed in with the same account as this console. Index API keys (created on the Index page) call it programmatically at https://api.tohou.io/v1/index?q=example.com with an Authorization: Bearer tix_… header, sharing the account's daily lookup budget. Domain searches return public certificate-transparency names and certificate inventories, current DNS records, public web observations and WHOIS/RDAP registration. Address searches return open-port records with service details, hostname and reverse-DNS records, network and ASN data, registry and geolocation information, and WHOIS registration. ASN searches return announced prefixes. Domain results add historical URLs from a public web archive; both domain and address results include a live observation — a bounded direct check of common service ports, HTTP(S) status and the TLS certificate — but only for targets inside your own verified scope. Every other lookup is answered from third-party public records without sending traffic to the target. Index lookups are stateless: no search history is stored and nothing is added to workspace inventory.

Authenticated read-only checks

Configure exact HTTPS paths with a dedicated low-privilege bearer token or session cookie. HEAD checks collect headers. GET checks require you to confirm the path is read-only, compare anonymous and authenticated status codes, and discard the response body after at most 16 KiB. An anonymous 2xx result is a review signal, not proof of an access-control vulnerability. Sonar follows no redirects.

Authorized intrusive testing (opt-in)

Separately from the observation above, workspaces authorized to actively test their own assets can enable a bounded, non-destructive active-check tier. It is off by default and gated three ways: the operator must enable it for the deployment, a workspace administrator must turn it on, and each asset requires its own explicit written consent. Only an asset meeting all three conditions is tested. The checks are detection-only — reflected-input markers (reflected XSS), a single error-trigger character (error-based SQL injection) and an external redirect marker (open redirect). They extract no data, change no state and never guess credentials. See the scanning policy for the full boundaries.

Scheduling and notifications

Each workspace chooses Manual, Daily, Weekly or Monthly runs with a count per period; gaps are spread evenly across UTC periods and shown before saving. Scheduled and manual runs share the same daily allowance, and a workspace runs one scan at a time. Add a Discord or Slack webhook when creating or editing a workspace to receive formatted finding and scan updates; delivery failures retry with increasing delays and are reported in console notifications.

Roles

Owners manage all workspace settings, members and deletion. Administrators manage assets, keys and analyst invitations. Analysts investigate findings, export reports and run scans. Only the platform operator can change capacity, suspend accounts or ban users.

API authentication

Create a scoped key in each workspace's Settings (account and Index keys live on the Index page). Send it in the Authorization header. The API hostname is api.tohou.io; endpoints use the /v1 prefix. The console also exposes the same endpoints under /api, and Settings includes an API explorer that runs read-only requests with your current session. Requests return JSON unless an export format is selected.

curl https://api.tohou.io/v1/assets -H "Authorization: Bearer $TOHOU_API_KEY"
curl "https://api.tohou.io/v1/index?q=8.8.8.8" -H "Authorization: Bearer tix_…"

Never include API keys in browser URLs or public repositories. Invalid keys return HTTP 401. Missing permissions return HTTP 403. Limits return HTTP 429.

Queue a scan

curl https://api.tohou.io/v1/scans -H "Authorization: Bearer $TOHOU_API_KEY" -H "Content-Type: application/json" --data '{"scopeId":"your-verified-scope-id"}'

Omit the scope ID to queue one run covering every verified asset in the workspace. A queued scan is not a completed scan; poll the scan list to inspect status, progress and the activity log.

Coverage and boundaries

Sonar performs real-time, bounded observation of verified scope only — by design, not a worldwide pre-built search index. Outside the opt-in, consent-gated intrusive tier described above, it performs no exploitation, credential attacks, denial-of-service testing, or decoy or spoofed-source scanning, and does not include cloud-account connectors. Exact behavior is defined by the scanning policy.

Changelog

Recent additions to the platform. Dates are approximate and features roll out behind the normal workspace controls.

• Sign-in — Google sign-in alongside Discord.
• Authorized intrusive testing — an opt-in, consent-gated tier of bounded, non-destructive active checks.
• Discovery — attribution discovery (candidate domains and mobile apps), exposed-secret scanning of a site's own scripts, API-surface detection, and favicon: pivots.
• Detection depth — technology fingerprinting, deeper mail security (MTA-STS, TLS-RPT, BIMI, DKIM), a read-only signature template engine, per-change alerts, and configurable port coverage.
• Vulnerability intelligence — CISA KEV and FIRST EPSS enrichment, risk-based finding priority, and remediation SLAs.
• Workflow — finding assignment notifications, bulk actions, suppression rules, re-test on demand, @mentions and an activity feed, and per-user notification preferences.
• Organization — asset tags, lifecycle states, watchlists, saved searches, and a ⌘K command palette.

Support

Contact [email protected] for account and product support. Report unexpected scanning to [email protected] with the target and UTC timestamp.