thalesgroup-cert/Watcher

What it solves

Watcher is a cybersecurity platform designed to automate the discovery and monitoring of emerging threats. It helps security teams aggregate fragmented threat intelligence, track potential data leaks, and identify suspicious domain activity in one centralized dashboard.

How it works

Built on a Django and React stack, Watcher acts as an orchestration hub for security data. It continuously pulls information from external sources like RSS feeds (CERTs), CVE databases, and certificate transparency logs. It uses Hugging Face models (Flan-T5 and BERT) to summarize threat reports and extract key entities from raw data. The platform then correlates these findings with user-defined rules and can automatically trigger alerts or push data to external security tools like TheHive or MISP.

Who it’s for

It is designed for security operations centers (SOCs) and cybersecurity analysts who need to monitor large-scale threat landscapes, manage domain legitimacy, and automate the ingestion of threat intelligence into their existing incident response workflows.

Highlights

• AI-Powered Analysis: Uses LLMs for automated weekly threat digests, breaking news summaries, and entity extraction.
• Comprehensive Monitoring: Tracks data leaks across platforms like GitHub and Pastebin, and monitors domains for typosquatting or malicious changes.
• Extensive Integrations: Native support for exporting Indicators of Compromise (IOCs) to MISP and TheHive, plus support for OIDC/LDAP authentication.
• Operational Efficiency: Includes bulk management tools, customizable dashboards, and a robust API for integration with existing ticketing and notification systems.