Watcher
Operator: Thales Group CERT
Self-hosted platform for cyber news, leak indicators and suspicious domains, with AI summaries.
Technical Infrastructure
Product
Free open-source web platform from Thales Group CERT. Runs on your own infrastructure; public research access is not promised.
Availability and source date
Active
As of: 16 October 2026.
No functionality test has been performed.
Use in OSINT research
Monitors selected domains and search terms. Brings together leads on similar domains, data leaks, vulnerabilities and new cyber threats.
Queries
| Input | Result | Result type |
|---|---|---|
| Domain / website | Similar or suspicious domains from dnstwist and Certificate Transparency; changes to IP, MX and web content for monitored domains. | Retrieved |
| Keyword / free text | Matching leads in connected sources and rule-based matches for vulnerabilities or ransomware victims. | Retrieved |
| Keyword / free text | AI-generated summaries of cyber threat topics from the collected sources. | Derived |
Features
- Collects cyber news from configured RSS sources.
- Finds similar domains and monitors new certificates.
- Monitors domains for changes to DNS, MX and web content.
- Searches for published leak indicators matching defined search terms.
- Creates AI summaries and reports matches through notification channels.
- Provides data through its own REST API and exports indicators to MISP.
Categories
- Technical Infrastructure
- Threat intelligence
Coverage
Dataset
RSS items, search engine results and certificate data collected by the instance, plus connected CVE and ransomware sources. Scope is determined by your own configuration.
Access
Installation and deployment
Locally installable · Self-hosted
Self-hosted Django/React web application. Docker Compose is officially documented; access your own instance through a browser.
Requirements
Your own Docker installation with a user account. Depending on the service, external integrations require separate keys or accounts.
Export
REST API; export of indicators to MISP and transfer of leads to TheHive.
Provider
Thales Group CERT
Country of establishment
Unknown
Interfaces
API
Available. Its own REST API with a token. Swagger and an OpenAPI schema are provided in your own instance at /api/docs/ and /api/schema/.
MCP
Not documented. No MCP server is described in the README, installation and release documentation reviewed.
AI agents
Not documented. AI summaries are built in. Integration with external AI agents is not described in the documentation reviewed.
Maintenance
Licence
AGPL-3.0
Latest activity
Commit 10/2026
Stars
approx. 1,400 (as of 16 October 2026)
Legal note
Limitations
- Results depend on the configured sources and search terms; it is not a comprehensive directory of all threats.
- AI summaries and lookalike domains are leads, not confirmation of an attack.
- The Pastebin integration requires a Pro account and approval of the public IP address.
Guides and practical reports
Official · Install Watcher / Use Watcher
Thales Group CERT · EN
Explains running it with Docker, user accounts, sources, rules and the REST API.