Watcher is an open-source, AI-powered cyber threat intelligence and hunting platform developed by Thales Group’s CERT. Built with Django and React, it continuously discovers and monitors emerging threats and turns raw security data into briefings analysts can act on. It has about 1,430 stars on GitHub and is actively maintained in 2026.
Threat intelligence teams drown in feeds: vulnerability disclosures, certificate streams, ransomware news, and social chatter. Watcher aggregates those sources and applies AI analysis on top. It produces automated weekly digests of the top trending cybersecurity topics, fires real-time alerts when breaking threats emerge, and generates on-demand summaries for any security keyword, complete with related CVE and threat actor details. Dedicated intelligence modules continuously fetch and correlate external data such as CVEs and ransomware activity, and integrations with tools like MISP and TheHive โ alongside certificate transparency monitoring via Certstream โ let findings flow into an existing security operations workflow. Watcher deploys on a web server or quickly via Docker, and full documentation is published on the project’s site. For analyst teams, the value is triage: instead of reading every feed item by hand, they start the day with ranked, summarized intelligence and only dig deeper where the platform flags real risk.
Watcher is free and open source under the AGPL-3.0 license, developed and released by Thales Group CERT for the defender community. You host it yourself; there is no commercial tier from the project.
Security operations teams, threat intelligence analysts, and CERTs that want an AI-assisted watchtower over vulnerabilities, ransomware, and emerging threats โ without paying for a commercial intelligence platform.