thalesgroup-cert/Watcher

Health v2 · maintenance only

Adoption not part of the score

1372 stars · 204 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Watcher is an open-source, self-hosted cyber threat intelligence and hunting platform built with Django and React JS. It uses AI to analyze threat feeds, detect phishing and data leaks, monitor sites, and integrates with MISP and TheHive for incident response workflows.

Use cases

• monitor emerging cybersecurity threats from RSS feeds with AI summaries
• detect phishing domains and typosquatting via DNS finder and certificate transparency
• get alerts on data leaks mentioning my domains or keywords
• monitor websites for defacement or suspicious changes
• export threat intelligence to MISP or create TheHive cases
• generate weekly digests of trending cyber threats and CVEs
• track threat actors and CVEs related to security keywords

When to choose

• you need a self-hosted CTI platform with AI-assisted analysis
• your SOC wants automated phishing, data leak, and site monitoring alerts
• you already use MISP or TheHive and want a feed/connector layer
• you want weekly trending threat digests and breaking news alerts

When to avoid

• you need a commercial enterprise CTI suite with vendor support
• you only want a lightweight CLI scanner rather than a full web platform
• you cannot run Docker or maintain a Django/React deployment

Facets

application · maturity active

monitoring alerting search-engine nlp machine-learning web-framework self-hosted osint security osint self-hosted python threat-intelligence threat-hunting misp thehive phishing-detection dns-finder data-leak-detection site-monitoring certstream django reactjs cybersecurity incident-response web-server docker linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="thalesgroup-cert/Watcher")