dokebi.org

What It Is

Dokebi positions itself as a “침해사고 수집/분석 플랫폼,” meaning an incident collection and analysis platform. The core module shown on the current page is IOC Search: users enter an IOC, and the platform performs a VirusTotal lookup; if the input is a URL or domain name, it additionally runs a URLScan query. The results show whether the indicator is considered malicious, along with detailed JSON data. The site also provides downloads for the latest version of Dokebi Collector, covering Windows x64, Linux x64 musl, macOS Intel, and macOS Apple Silicon, plus a link to the GitHub repository.

Core Capabilities and Integrations

In terms of protection type, Dokebi is more focused on threat intelligence analysis, IOC triage, and assisted incident analysis rather than being a traditional firewall, EDR, or vulnerability scanner. Its value lies in simplifying the workflow for querying external intelligence sources: any IOC can be checked via VirusTotal, while URLs and domains can also be checked through URLScan, helping analysts quickly assess suspicious indicators. The JSON details may be useful for security operations and automated analysis, but the page does not state whether it offers an API, bulk queries, history, access control, or alert integrations.

Deployment, Pricing, and Compliance

For deployment, the web-based IOC Search is clearly available, and the Collector provides downloadable executables for multiple platforms. However, the page does not clarify whether the server side is SaaS-based or self-hostable. Pricing, free quotas, commercial licensing, and payment methods are not disclosed. Information on compliance certifications, data retention, privacy policies, and audit logs is also missing. If used in an enterprise production environment, further confirmation is needed on whether uploaded IOCs or incident data are passed to third-party platforms, and how VirusTotal and URLScan API keys and quota mechanisms are handled.

Pros, Cons, and Who It’s For

The strengths are its straightforward functionality and low learning curve, making it suitable for incident responders, security analysts, and SOC teams that need to quickly verify IOCs such as IP addresses, domains, and URLs while handling alerts. The Collector’s multi-platform support also makes it convenient for collecting information across different endpoint environments. The downside is that public information is very limited, making it difficult to judge the platform’s stability, support services, team background, and commercialization capabilities. Its analysis quality also depends heavily on external services such as VirusTotal and URLScan.

Access from China and Alternatives

The source page does not provide information about access from mainland China. In practice, connectivity may also be affected by access to external sites such as VirusTotal and URLScan, so availability is marked as unknown. If there are concerns around access, compliance, or cross-border data transfer, alternatives worth evaluating include VirusTotal, urlscan.io, AlienVault OTX, MISP, OpenCTI, or domestic threat intelligence and SOC platforms.