A SOAR platform that actually reads the news for you

What it does

Watcher is a Django/React security operations platform that ingests threat data from dozens of sources—CERT advisories, certificate transparency logs, ransomware trackers, code repositories, and even Pastebin—then surfaces what matters through keyword-based “Watch Rules.” It also monitors for typosquats of your domains, tracks leaked credentials, and can push findings to TheHive or MISP. Docker deployment is a single make up away.

The interesting bit

Instead of just aggregating feeds, Watcher runs local Hugging Face models (FLAN-T5 for summarization, BERT-NER for IOC extraction) to generate weekly digests and breaking-news alerts. The AI angle is practical, not performative: it turns raw RSS noise into paragraphs a human might actually read.

Key highlights

• Certificate transparency monitoring via CertStream catches suspicious domain registrations in real time
• TLSH fuzzy hashing detects when monitored malicious domains change content or infrastructure
• Full TheHive sync with auto-created alerts and pre-built Cortex analyzers
• MISP export with UUID tracking for collaborative IOC sharing
• SSO/OIDC, LDAP, or local auth; Swagger UI auto-generated at /api/docs/

Caveats

• Pastebin monitoring requires a paid Pro account and IP whitelisting
• The README claims “10 minutes” to deploy but doesn’t specify hardware requirements for running the ML models locally
• Some feature descriptions (“smart case management,” “smart UUID tracking”) are vague on what “smart” actually means

Verdict

Security teams drowning in open-source feeds but allergic to commercial TI platforms should evaluate this. If you already have a mature Splunk/Elastic SOAR pipeline, Watcher may duplicate effort.