thalesgroup-cert/Watcher

What it solves

Watcher is an automated cybersecurity threat detection platform that helps security teams discover and monitor emerging threats, vulnerabilities, and data leaks. It centralizes the process of gathering intelligence from fragmented sources like RSS feeds, certificate transparency logs, and public leak sites, reducing the manual effort required to track threat actors and malicious infrastructure.

How it works

Built with Django and React, the platform integrates multiple specialized tools and AI models to automate security monitoring:

• AI Analysis: Uses Hugging Face Transformers, specifically flan-t5-base for text generation and bert-base-NER for Named Entity Recognition, to summarize threat intelligence and extract Indicators of Compromise (IOCs).
• Domain Monitoring: Employs dnstwist for typosquatting detection and certstream for real-time certificate monitoring.
• Data Leak Detection: Scans platforms like GitHub, GitLab, Pastebin, and npm registries for sensitive information exposure.
• Integration: Syncs findings with security tools like TheHive for case management and MISP for collaborative threat intelligence sharing.

Who it’s for

Security Operations Centers (SOCs), CERT teams, and cybersecurity analysts who need a centralized system to monitor organizational threats, track malicious domains, and manage threat intelligence feeds.

Highlights

• AI-Powered Intelligence: Generates automated weekly digests of trending topics and on-demand summaries for security keywords.
• Comprehensive Surveillance: Monitors CVEs, ransomware victims, and malicious domain changes using TLSH fuzzy hashing.
• Broad Leak Detection: Tracks sensitive data across diverse platforms including StackOverflow and Bitbucket.
• Enterprise Readiness: Supports SSO/OpenID Connect, LDAP, and granular access control.
• Extensible Ecosystem: Includes a dedicated connectors dashboard for managing integrations with Slack, SMTP, and other security tools.