Watcher
AI-powered open-source cyber threat intelligence and hunting platform.
Monitoremerging cybersecurity threats with Django, React, and Hugging Face AI.
Watcher is an open-source cyber threat intelligence and hunting platform built with Django and React. It uses AI models like Hugging Face's Flan-T5 and BERT to process threat feeds, track CVEs, and monitor information leaks.
What it is
The platform automates threat discovery by pulling CVEs, ransomware data, and emerging vulnerabilities from CERT feeds. It uses AI to generate weekly digests, extract named entities, and summarize security keywords.
Who it's for
Suits security operations and threat intelligence teams needing a self-hosted platform to aggregate feeds and monitor leaks. Does not suit organizations lacking infrastructure to manage a multi-container Django and React stack.
Key features
AI-Driven Threat Intelligence
Generates automated weekly digests and real-time alerts for top trending cybersecurity topics using Hugging Face models.
CVE & Ransomware Tracking
Continuously fetches external threat data from circl.lu, ransomware.live, and ransomwarelook.io.
Information Leak Monitoring
Detects sensitive data exposure across Pastebin, GitHub, GitLab, npm registries, and other public platforms.
Domain & Typosquatting Surveillance
Identifies suspicious domains using dnstwist generation and Certstream Certificate Transparency monitoring.
TheHive & MISP Integration
Synchronizes indicators of compromise and alerts directly into TheHive and MISP platforms.
Up and running in 3 steps
Our honest verdict
What's great
- Built-in AI summarization and named entity extraction via Hugging Face models
- Out-of-the-box integration with TheHive, MISP, and multiple CERT RSS feeds
- Detailed monitoring for data leaks across Pastebin, code repositories, and package registries
- Comprehensive domain surveillance using dnstwist and Certstream
Where it falls short
- Requires Docker and manual environment configuration to deploy and run locally
- Using the Pastebin API feature requires a paid Pastebin Pro account and a whitelisted IP
- Heavy resource consumption expected due to running local Hugging Face transformer models inside the stack
Pricing & license
Free under the AGPL-3.0 licence. The only cost is running the infrastructure and server resources yourself.
Open remote AI-training roles
880 open remote AI-training roles, updated November 15, 2026; most pay $20–$175 an hour. Zekai lists them free; the application goes to the employer’s platform.
Alternatives
These reviewed AI tools do the same job instantly — from our scored directory.
Use it, or have us set it up
FAQ
What AI models does Watcher use?
It uses google/flan-t5-base for text-to-text threat summaries and dslim/bert-base-NER for named entity and IOC extraction.
Can I export indicators of compromise to MISP?
Yes, Watcher features native PyMISP integration for exporting IOCs with smart UUID tracking and automatic object creation.
Is a paid Pastebin account required?
Yes, to use Watcher's Pastebin API feature, you must subscribe to a Pastebin Pro account and whitelist your public IP.
