AI-powered threat intelligence platform for automated CVE/ransomware monitoring, domain surveillance, data leak detection, and incident response with MISP/TheHive integration.
AI-Powered Automated Cybersecurity Threat Detection Platform
Watcher is a Django & React JS platform designed to discover and monitor emerging cybersecurity threats with AI-powered threat intelligence analysis. It can be deployed on webservers or quickly run via Docker.
Watcher empowers your security operations with comprehensive threat detection and monitoring:
AI-Driven Threat Intelligence - Transform raw threat data into actionable intelligence with automated weekly digests of top-5 trending cybersecurity topics, real-time breaking news alerts when threats emerge, on-demand summaries for any security keyword including related CVE and threat actor details.
CVE & Ransomware Intelligence - Continuously fetch, correlate, and surface external threat data: CVEs from cve.circl.lu, ransomware victims and groups from ransomware.live and ransomlook.io. Define keyword-based Watch Rules to get alerted when specific threats match your organisation's context.
Emerging Threat Detection - Monitor cybersecurity trends via RSS feeds from CERT-FR (www.cert.ssi.gouv.fr), CERT-EU (www.cert.europa.eu), US-CERT (www.us-cert.gov), Australian Cyber Security Centre (www.cyber.gov.au), and more. Track new vulnerabilities, malware campaigns, and threat advisories as they appear.
Legitimate Domain Management - Centralized approved domains with expiry, repurchase status, registrar info, and contacts. Easily convert monitored malicious domains into legitimate ones. Automated UDRP case tracking.
Information Leak Monitoring - Detect sensitive data exposure across the webs including Pastebin, StackOverflow, GitHub, GitLab, Bitbucket, APKMirror, npm registries, and other platforms. Catch leaked credentials, API keys, and confidential information early.
Malicious Domain Surveillance - Monitor malicious domains for changes in IP addresses, mail/MX records, and web content. Use TLSH fuzzy hashing to detect modifications. Automatic RDAP/WHOIS checks with registrar and expiry alerts.
Suspicious Domain Detection - Identify potentially malicious domains targeting your organisation via:
Extend Watcher's capabilities with powerful integrations and management tools:
.env/connectors page to view, edit, and test every external integration (SMTP, Slack, Citadel, TheHive, MISP, CyberWatch feeds, and more) from one place, with encrypted credential storage and per-connector health checks./api/docs/ and OpenAPI 3 schema at /api/schema/ powered by drf-spectacularWatcher leverages open source tools and libraries:
Watcher offers multiple visual themes to match your preferences and working environment.
Django provides a ready-to-use user interface for administrative activities. We all know how an admin interface is important for a web project: Users management, user group management, Watcher configuration, usage logs...
# 1. Clone the repo
git clone https://github.com/thalesgroup-cert/watcher.git
cd watcher/deployment
# 2. Initialize environment, configs & directory structure
make init
# 3. Start the stack
make up
# 4. On first run: run database migrations + create superuser
make migrate
make superuser
make populate-db
# 5. Open the web UI
# http://localhost:9002 (or your configured domain/port)
Get Watcher up and running in just 10 minutes using Docker. Detailed instructions available in our Installation Guide
Watcher's modular architecture ensures scalability, reliability, and easy integration with your existing security stack.
We welcome contributions from the security community!
To report bugs, request features, or submit code, please read our full Contributing Guide.
In order to use Watcher pastebin API feature, you need to subscribe to a pastebin pro account and whitelist Watcher public IP (see https://pastebin.com/doc_scraping_api).