AI-powered threat intelligence platform for automated CVE/ransomware monitoring, domain surveillance, data leak detection, and incident response with MISP/TheHive integration.
AI-Powered Automated Cybersecurity Threat Detection Platform
Watcher is a Django & React JS platform designed to discover and monitor emerging cybersecurity threats with AI-powered threat intelligence analysis. It can be deployed on webservers or quickly run via Docker.
Watcher empowers your security operations with comprehensive threat detection and monitoring:
AI-Driven Threat Intelligence - Transform raw threat data into actionable intelligence with automated weekly digests of top-5 trending cybersecurity topics, real-time breaking news alerts when threats emerge, on-demand summaries for any security keyword including related CVE and threat actor details.
CVE & Ransomware Intelligence - Continuously fetch, correlate, and surface external threat data: CVEs from cve.circl.lu, ransomware victims and groups from ransomware.live and ransomlook.io. Define keyword-based Watch Rules to get alerted when specific threats match your organisation's context.
Emerging Threat Detection - Monitor cybersecurity trends via RSS feeds from CERT-FR (www.cert.ssi.gouv.fr), CERT-EU (www.cert.europa.eu), US-CERT (www.us-cert.gov), Australian Cyber Security Centre (www.cyber.gov.au), and more. Track new vulnerabilities, malware campaigns, and threat advisories as they appear.
Legitimate Domain Management - Centralized approved domains with expiry, repurchase status, registrar info, and contacts. Easily convert monitored malicious domains into legitimate ones. Automated UDRP case tracking.
Information Leak Monitoring - Detect sensitive data exposure across the webs including Pastebin, StackOverflow, GitHub, GitLab, Bitbucket, APKMirror, npm registries, and other platforms. Catch leaked credentials, API keys, and confidential information early.
Malicious Domain Surveillance - Monitor malicious domains for changes in IP addresses, mail/MX records, and web content. Use TLSH fuzzy hashing to detect modifications. Automatic RDAP/WHOIS checks with registrar and expiry alerts.
Suspicious Domain Detection - Identify potentially malicious domains targeting your organisation via:
Extend Watcher's capabilities with powerful integrations and management tools:
.env/connectors page to view, edit, and test every external integration (SMTP, Slack, Citadel, TheHive, MISP, CyberWatch feeds, and more) from one place, with encrypted credential storage and per-connector health checks./api/docs/ and OpenAPI 3 schema at /api/schema/ powered by drf-spectacular