Watcher

No entries match these filters. Clear filters

1. v3.7.0 Oct 19, 2026 · issue 114

   Watcher v3.7.0 adds bulk create and bulk actions across all modules, with new REST endpoints and configurable item limits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.7.0 https://github.com/thalesgroup-cert/Watcher.git
   # already have the repo? check out this version:
   $ git checkout v3.7.0

   └──▷ USE IT
   Raise the bulk-create ceiling to 500 lines per request when ingesting large domain threat feeds into Watcher.
   .env copy

   BULK_CREATE_MAX_ITEMS=500
   BULK_ACTION_MAX_ITEMS=500

   • Adds BULK_CREATE_MAX_ITEMS and BULK_ACTION_MAX_ITEMS env vars to .env to cap bulk request sizes (both default to 200; requests above the limit are rejected wholesale).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds POST <endpoint>/bulk_create/, bulk_update/, and bulk_delete/ endpoints to every module's API, each returning a per-item report of created / skipped / errors.
   • Adds bulk_export_legitimate/ and bulk_export_misp/ endpoints on /api/site_monitoring/site/ to export selected suspicious domains to Legitimate Domains or MISP (one MISP event per site).
   • Adds a One item per line bulk-add toggle to add forms for Legitimate Domains, Suspicious Domains, DNS Threats Monitored (domains and keywords), Data Leak search patterns, Banned Words, and Monitored Keywords.
   • Adds a Preview button on bulk-add forms to show what would be created without saving.

   +2 more show less

   • Adds bulk row actions to all tables — tick multiple rows to change legitimacy, takedown/legal-team/blocking requests, alert level, or status in one step, or delete them together.
   • Lists and dashboard statistics now refresh without a full page reload after bulk actions.
   • Adds BULK_CREATE_MAX_ITEMS and BULK_ACTION_MAX_ITEMS env vars to .env to cap bulk request sizes (both default to 200; requests above the limit are rejected wholesale).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds POST <endpoint>/bulk_create/, bulk_update/, and bulk_delete/ endpoints to every module's API, each returning a per-item report of created / skipped / errors.
   • Adds bulk_export_legitimate/ and bulk_export_misp/ endpoints on /api/site_monitoring/site/ to export selected suspicious domains to Legitimate Domains or MISP (one MISP event per site).
   • Adds a One item per line bulk-add toggle to add forms for Legitimate Domains, Suspicious Domains, DNS Threats Monitored (domains and keywords), Data Leak search patterns, Banned Words, and Monitored Keywords.
   • Adds a Preview button on bulk-add forms to show what would be created without saving.

   +1 more show less

   • Adds bulk row actions to all tables — tick multiple rows to change legitimacy, takedown/legal-team/blocking requests, alert level, or status in one step, or delete them together.

   1 more in Everything

2. v3.6.1 Oct 2, 2026 · issue 093

   Watcher v3.6.1 adds a ?site=<id> alert filter API and /16 network memory for smarter Website Monitoring alerting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.6.1 https://github.com/thalesgroup-cert/Watcher.git
   # already have the repo? check out this version:
   $ git checkout v3.6.1

   └──▷ TRY IT
   Retrieve all alerts for a specific monitored site by ID, useful for dashboards or incident triage without wading through alerts from other sites.
   copy

   $ curl -s 'https://<watcher-host>/api/site_monitoring/alert/?site=42' -H 'Authorization: Token <your-api-token>'

   Pin the CertStreamCertStreamA real-time feed of SSL/TLS certificates logged to Certificate Transparency logs, maintained by Calidog Security, giving cyber tools instant visibility into newly issued certificates for domain monitoring or phishing detection. image to v1.8.2 in a proxy-aware deployment so upgrades to the latest tag do not silently break certificate transparency monitoring.
   deployment/.env copy

   CERTSTREAM_VERSION=v1.8.2
   SEARX_PATH=../Searx/searx

   • Adds ?site=<id> query parameter to the /api/site_monitoring/alert/ endpoint to load alerts scoped to a specific monitored site.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds CERTSTREAM_VERSION variable to Docker Compose and Helm chart to pin the certstream-server-go image version (currently v1.8.2).
   • Sets SEARX_PATH=../Searx/searx in deployment/.env to correctly point SearxNG at an existing settings.yml instead of generating a proxy-incompatible one.
   • CertStream keyword matching is now case-insensitive, and certificates without a subject CN are matched against their SAN list.
   • Adds a CertStream watchdog that resets silent connections and logs a CertStream stats line every 5 minutes.
   • Adds ?site=<id> query parameter to the /api/site_monitoring/alert/ endpoint to load alerts scoped to a specific monitored site.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds CERTSTREAM_VERSION variable to Docker Compose and Helm chart to pin the certstream-server-go image version (currently v1.8.2).
   • Adds a CertStream watchdog that resets silent connections and logs a CertStream stats line every 5 minutes.

   2 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The SEARX_PATH default value has changed from ../Searx to ../Searx/searx in deployment/.env.example; deployments using the old value must update deployment/.env and remove any auto-generated Searx/settings.yml, then recreate the searxng container.
   • !The certstream image is now pinned to 0rickyy0/certstream-server-go:v1.8.2 via the new CERTSTREAM_VERSION variable; Compose files that override the certstream image with latest will pull v1.9/v1.10, which cannot stream behind an HTTP proxy.
   • !Compose files that override the watcher environment must explicitly add certstream to no_proxy, or the CertStream WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. will be incorrectly routed through the corporate proxy.
3. v3.6.0 Oct 1, 2026 · issue 092

   Unified DNS Threats Monitored table via /api/dns_finder/threats_monitored/, per-row triage workflow, and a first Kubernetes Helm chart under kubernetes/watcher/.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.6.0 https://github.com/thalesgroup-cert/Watcher.git
   # already have the repo? check out this version:
   $ git checkout v3.6.0

   • New detectionNew /api/dns_finder/threats_monitored/ endpoint serves a unified table merging dnstwist typosquats, Certificate TransparencyCertificate TransparencyA public, append-only log system maintained by various operators (Google runs several) that records every TLS certificate issued, letting anyone audit CAs for misissued or rogue certificates. keyword hits, and Subdomain Takeover findings in one view, with a Source filter (sub-filters: Fuzzer, Corporate Keyword, Provider) to narrow by origin.
   • New Helm chart under kubernetes/watcher/ deploys Watcher, SearxNG, and CertStreamCertStreamA real-time feed of SSL/TLS certificates logged to Certificate Transparency logs, maintained by Calidog Security, giving cyber tools instant visibility into newly issued certificates for domain monitoring or phishing detection. with an optional Bitnami MySQL subchart, Ingress, migration Job, and secrets; settings available in kubernetes/watcher/values.yaml.
   • Unified triage status (Pending, Suspected, Confirmed, Resolved, False Positive) is now editable per-row across all three threat sources from a dropdown with no confirmation modal.
   • Comments of up to 300 characters can be added to any finding via the Edit modal.
   • Corporate proxy configured via HTTP_PROXY / HTTPS_PROXY in deployment/.env is now honoured by the Watcher backend; add internal service hostnames to NO_PROXY in deployment/.env to bypass the proxy for them.

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !In /api/dns_finder/alert/, the status field is now a string (pending, suspected, confirmed, resolved, false_positive) instead of true/false — any external script or integration that reads or writes this field must be updated.
   • !The database schema and data migrations applied by make migrate are not reversible — back up the database with make backup before upgrading.
   • !The Watcher backend now reads HTTP_PROXY / HTTPS_PROXY from deployment/.env — if Watcher previously reached internal services (TheHive, MISP, SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. relay, etc.) directly, add their hostnames to NO_PROXY in deployment/.env before running make up or those calls will be routed through the corporate proxy.
4. v3.5.2 Jul 22, 2026 · issue 022

   Watcher v3.5.2 adds a Connectors dashboard for centralizing integrations, Fernet-encrypted credentials, and SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. auto-provisioning control.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.5.2 https://github.com/thalesgroup-cert/Watcher.git
   # already have the repo? check out this version:
   $ git checkout v3.5.2

   └──▷ TRY IT
   Prevent SSO from auto-creating accounts for unknown users — only pre-approved admin-created accounts can log in via OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user..
   copy

   $ OIDC_CREATE_USER=False

   Verify all external integrations are reachable after a network change, without waiting for the Monday scheduled job.
   📍Navigate to /connectors (as superuser), then click Test next to each connector to see Healthy / Unhealthy status in real time.
   • New /connectors dashboard (superuser only) centralizes configuration, live overrides, and health-check testing for all external integrations (SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure., Slack, TheHive, MISP, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., OIDC, MISP, CertStreamCertStreamA real-time feed of SSL/TLS certificates logged to Certificate Transparency logs, maintained by Calidog Security, giving cyber tools instant visibility into newly issued certificates for domain monitoring or phishing detection., SearxNG, CyberWatch, WIPO UDRP, MySQL).
   • Per-connector live connectivity tests report Healthy / Unhealthy / Not tested yet status alongside Configured / Incomplete / Disabled state.
   • Scheduled job automatically tests every connector each Monday at 06:00 and raises a Pending Action alert only for configured connectors that fail, without duplicating alerts on repeated failures.
   • Sensitive connector fields (passwords, tokens, API keys) are now encrypted at rest with Fernet; existing stored values are re-encrypted automatically on migration.
   • New OIDC_CREATE_USER setting lets admins restrict SSO login to pre-existing accounts, disabling auto-provisioning of new users on first login.

   +3 more show less

   • Added Server banner / X-Powered-By monitoring as a connector-backed check.
   • Added connectors/contrib/_template scaffold to accelerate building new connectors.
   • Quick-pick shortcut buttons (1 month / 3 months / 6 months / 1 year) added to Expiry Date, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. Expiry Date, and End of Monitoring date pickers.

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !This release includes database schema changes — run python manage.py migrate after updating or connector credential storage and new settings will not function correctly.
5. v3.5.0 Jun 30, 2026 · issue 020

   Watcher v3.5.0 adds a Timeline audit trail, UDRP approval workflow, a reworked ThreatsWatcher dashboard, and auto-fit table pagination.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.5.0 https://github.com/thalesgroup-cert/Watcher.git
   # already have the repo? check out this version:
   $ git checkout v3.5.0

   └──▷ HOW TO FIND IT
   Review and approve a queued UDRP domain transfer so no won case promotes a domain without human sign-off.
   📍In the Watcher UI, navigate to the PendingActions list, locate the entry with status pending, review the payload, then click Approve (or Reject) to trigger or cancel the domain transfer.
   • Adds a full Timeline audit trail module that records every create, update, and delete action across all Watcher modules, with per-object history panels, field-level diffs, and actor avatars visible in every table row.
   • New /api/timeline/events/ endpoint lets practitioners query the full history of any tracked object by content type and object ID.
   • Introduces a PendingActions approval workflow for UDRP case transfers: when a case is marked won, a PendingAction is queued for admin review instead of automatically calling transfer_to_legitimate_domains().
   • Adds API endpoints for listing, approving, and rejecting pending actions, secured by existing permission guards.
   • New avatar_color field on UserProfile automatically assigns a deterministic color to each user on first login, surfaced as color-coded initials throughout the UI.

   +2 more show less

   • ThreatsWatcher dashboard redesigned with a new ResizableContainer split-pane layout, a WordSummary AI summary panel alongside post URLs, and a draggable divider with localStorage persistence.
   • Removes Google Fonts CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. calls; all icon and font assets are now served locally, eliminating external network dependencies at page load.

   7 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The new timeline Django app requires a database migration (python manage.py migrate) and must be present in INSTALLED_APPS with its URLs registered — pull the updated settings.py and urls.py or add them manually before starting the service.
6. v3.4.0 May 12, 2026 · release notes

   New CyberWatch threat intel module, OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user. auth, interactive map, KPI panels, and new API docs in Watcher v3.4.0

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.4.0 https://github.com/thalesgroup-cert/Watcher.git
   # already have the repo? check out this version:
   $ git checkout v3.4.0

   └──▷ USE IT
   Enable SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. login while keeping local form auth as fallback.
   env copy

   LOGIN_MODE=both
   OIDC_RP_CLIENT_ID=<your_client_id>
   OIDC_RP_CLIENT_SECRET=<your_client_secret>

   View the OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. 3 schema for programmatic client generation.
   copy

   $ curl -s https://<your-domain>/api/schema/ | jq .info.title

   Trigger the OIDC callback flow after configuring your IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems..
   📍# Register this URL in your OIDC provider https://<your-domain>/api/auth/oidc/callback/
   • Adds the CYBER_WATCH_CVE_API_URL environment variable to configure the CVE source endpoint.
   • Adds CYBER_WATCH_RANSOMWARE_GROUPS_URL, CYBER_WATCH_RANSOMWARE_VICTIMS_URL, and CYBER_WATCH_RANSOMLOOK_* environment variables for ransomware data sources.
   • Adds LOGIN_MODE, OIDC_COMPANY_NAME, OIDC_RP_CLIENT_ID, and OIDC_RP_CLIENT_SECRET configuration keys to control federated login behavior.
   • Adds the /api/auth/oidc/callback/ endpoint for handling OIDC authentication responses.
   • Adds /api/docs/ (Swagger UI) and /api/schema/ (OpenAPI 3 JSON) endpoints for API documentation.

   +6 more show less

   • Adds udrp_status and udrp_last_checked fields to the Site model for UDRP case tracking.
   • Adds a new CyberWatch module with a standalone dashboard accessible from main navigation.
   • Adds KPI panels to all six modules via dedicated /statistics/ API endpoints.
   • Adds an interactive world map in Threats Watcher powered by MapLibre GL for visualizing RSS sources and ransomware victims.
   • Enables drag-and-drop resizing of dashboard panels with layout persistence in localStorage.
   • Adds /profile route with theme picker and layout manager for user preferences.

   11 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The OIDC_ENABLED environment variable has been removed; use LOGIN_MODE instead.
7. v3.3.1 Apr 27, 2026 · release notes

   Watcher v3.3.1 adds a modular Makefile-based deployment helper for simplified Docker setup.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.3.1 https://github.com/thalesgroup-cert/Watcher.git
   # already have the repo? check out this version:
   $ git checkout v3.3.1

   └──▷ HOW TO FIND IT
   Use the new modular deployment helper to launch Watcher in a production environment.
   📍cd deployment/ && make up
   • Adds deployment/ directory with make commands as a simplified method to deploy Watcher via Docker.

   1 detail in Everything

8. v3.3.0 Feb 18, 2026 · release notes

   Watcher v3.3.0 adds local CertStreamCertStreamA real-time feed of SSL/TLS certificates logged to Certificate Transparency logs, maintained by Calidog Security, giving cyber tools instant visibility into newly issued certificates for domain monitoring or phishing detection. server, SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. expiry tracking, and regex keyword matching.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.3.0 https://github.com/thalesgroup-cert/Watcher.git
   # already have the repo? check out this version:
   $ git checkout v3.3.0

   └──▷ HOW TO FIND IT
   Enable regex pattern matching for a keyword to detect complex email patterns.
   📍# In the Keyword model UI or API, set is_regex to true and use patterns like [a-zA-Z0-9._%+-]+@company\.com
   Track SSL certificate expiration dates for monitored domains.
   📍# The system now automatically populates LegitimateDomain.ssl_expiry and Site.ssl_expiry # No new CLI flag is required; ensure periodic checks are enabled in the UI
   • Adds a CERT_STREAM_URL environment variable to configure the local WS endpoint for certificate transparency monitoring
   • Introduces the certstream-config.yaml file with webserver, prometheus, and WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. endpoint configuration keys
   • Adds new LegitimateDomain.ssl_expiry, Site.ssl_expiry, Site.domain_created_at, Alert.new_ssl_expiry, and Alert.old_ssl_expiry database fields for SSL certificate tracking
   • Adds an is_regex boolean field to the Keyword model to enable regex pattern matching instead of literal string matching
   • Migrates the search engine service from searx to searxng with corresponding container name and image updates

   5 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The searx service in docker-compose.yml must be renamed to searxng; existing container names and hostnames referencing searx are invalid.
   • !The SEARX_COMMAND environment variable is no longer used and may cause confusion if left in .env.
9. v3.2.2 Dec 19, 2025 · release notes

   Adds Bluesky as a new threat intelligence source and refines source confidence classification.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.2.2 https://github.com/thalesgroup-cert/Watcher.git
   # already have the repo? check out this version:
   $ git checkout v3.2.2

   └──▷ TRY IT
   Repopulate the database after upgrading to v3.2.2 so the new Bluesky sources are included in the threat watch list.
   copy

   $ docker compose run watcher bash -c 'python manage.py populate_db'

   • Adds Bluesky as a supported external source for monitoring cybersecurity threats and industry buzz
   • Introduces refined source confidence classification to better reflect reliability and trust levels for ingested data

   2 details in Everything

10. v3.2.0 Dec 16, 2025 · release notes

    Adds pagination to API endpoints for Data Leak, Site Monitoring, DNS Finder and Legitimate Domains modules

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.0 https://github.com/thalesgroup-cert/Watcher.git
    # already have the repo? check out this version:
    $ git checkout v3.2.0

    └──▷ TRY IT
    Fetch the first batch of data leak alerts in smaller chunks to reduce memory usage and improve response time.
    copy

    $ curl -s 'https://watcher.example.com/api/data-leak/alerts?page=1&page_size=50' | jq '.data[]'

    Retrieve paginated DNS monitored entries for a specific keyword.
    copy

    $ curl -s 'https://watcher.example.com/api/dns-finder/dns_monitored?page=2&page_size=100' | jq '.data[]'

    • ?page=<page>&page_size=<size> query parameters now supported on Data Leak, Site Monitoring, DNS Finder and Legitimate Domains API endpoints with configurable page_size (1–1000, default 100)
    • Threats Watcher article lists now support pagination via the same page/page_size parameters

    2 details in Everything

11. v3.0 Nov 3, 2025 · release notes

    Watcher v3.0 introduces Legitimate Domains module, AI threat summaries, RDAPRDAPA JSON-based protocol for querying domain and IP registration data, standardized by the IETF as a modern replacement for WHOIS, giving cyber tools structured, machine-readable ownership and contact lookups. discovery, and configurable weekly/breaking news settings

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0 https://github.com/thalesgroup-cert/Watcher.git
    # already have the repo? check out this version:
    $ git checkout v3.0

    └──▷ TRY IT
    Run the new Legitimate Domains module migration to initialize the database schema.
    copy

    $ docker compose run watcher bash
    python manage.py migrate

    • Adds LegitimateDomain module with dedicated API for CRUDCRUDThe four basic database operations — Create, Read, Update, Delete — used as shorthand for any system that manages persistent data records, giving cyber tools a standard model for interacting with stored information. operations on company-approved domains
    • Adds WEEKLY_SUMMARY_DAY, WEEKLY_SUMMARY_HOUR, and BREAKING_NEWS_THRESHOLD to .env for controlling report schedules and alert thresholds
    • Adds RDAP alert support for tracking registration changes via the new RDAPDiscovery class
    • Adds Hugging Face transformers integration for AI-driven NER and text summarization in threat reports
    • Adds ResizableContainer and TableManager components for customizable dashboard panel widths, filtering, sorting, and pagination

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Major database schema changes require running python manage.py migrate after pulling the new Docker image to prevent data loss
12. v2.4 Jul 31, 2025 · release notes

    Watcher v2.4 adds reliability scoring via confident column in sources.csv, BERTBERTA transformer encoder trained to understand text using context on both sides of a word. Its representations are useful for search, classification and other language-understanding tasks.-based NER for entity detection, and a refactored 30-day trending algorithm.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4 https://github.com/thalesgroup-cert/Watcher.git
    # already have the repo? check out this version:
    $ git checkout v2.4

    • Adds a confident field to sources.csv (values: 1 = 100%, 2 = 50%, 3 = 20%) to weight source reliability.
    • Switches entity extraction engine from previous implementation to BERT-base-NER for improved detection in news titles.
    • Changes the trending calculation window to only consider headlines from the last 30 days, preventing old surges from dominating trends.
    • Adds a Reliability % column to the Watcher UI table to display the averaged confidence score of sources for each trending word.
    • Reduces the minimum occurrence threshold for trend detection from 7 to 5 (configurable in settings.py).

    +1 more show less

    • The update procedure requires manual deletion of Source, BannedWord, and TrendyWord database tables before running migrations to prevent conflicts with new fields.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !sources.csv now requires a confident column; missing this field will result in incorrect reliability scoring or processing errors.
13. v2.2.0 Jul 2, 2025 · release notes

    MISP export now supports exporting to a specific Event UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. and creating MISP objects.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.2.0 https://github.com/thalesgroup-cert/Watcher.git
    # already have the repo? check out this version:
    $ git checkout v2.2.0

    • Adds support for specifying a MISP Event UUID during IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. export to update an existing event.
    • Enhances MISP export logic to create MISP objects (e.g., domain, ip-port) instead of just attributes.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The environment variable ALLOWED_HOST is renamed to ALLOWED_HOSTS and must be defined in .env.
14. v2.1.1 Feb 12, 2025 · release notes

    Watcher v2.1.1 adds automatic subdomain ingestion into TheHive cases from Website Monitoring DNS Finder alerts.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.1 https://github.com/thalesgroup-cert/Watcher.git
    # already have the repo? check out this version:
    $ git checkout v2.1.1

    • Adds Website Monitoring integration with DNS Finder to automatically feed parent domain cases/alerts with discovered subdomains.
    • Refines TLP, PAP, Severity, and observable tags for improved classification and response accuracy in TheHive.

    2 details in Everything

15. v2.1 Jan 9, 2025 · release notes

    Watcher v2.1 introduces TheHive, Citadel, and Slack notification integrations plus SMTPS email support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1 https://github.com/thalesgroup-cert/Watcher.git
    # already have the repo? check out this version:
    $ git checkout v2.1

    • SMTPS replaces SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. for email notifications to enhance transport security.
    • The TheHive integration enables automatic alert creation via TheHive APIs.
    • The Citadel integration delivers notifications through the Citadel enterprise application APIs.
    • Slack notifications are now supported, allowing direct delivery via Slack APIs.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Email notifications now require SMTPS; existing SMTP configurations will fail without updating the SMTPS endpoint/credentials in .env.
16. v2.0 Aug 14, 2024 · release notes

    Watcher v2.0 adds API key management for granular access control and replaces RSS-Bridge with new sources

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0 https://github.com/thalesgroup-cert/Watcher.git
    # already have the repo? check out this version:
    $ git checkout v2.0

    └──▷ TRY IT
    Ingest the new RSS sources after upgrading to v2.0
    copy

    $ python manage.py populate_db

    • populate_db command to ingest over 200 new cybersecurity RSS sources
    • Administrative capability to create one or more API keys per user

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The rss-bridge container has been removed; delete it from your docker-compose.yml file
    • !MySQL versions >= 8.2.X are incompatible with Watcher and may impair its functionality
    • !RSS sources associated with the old RSS-Bridge setup are obsolete and can be deleted
17. v1.2.2 Dec 9, 2021 · release notes

    Adds real-time certificate transparency monitoring via Certstream and configurable TheHive/MISP tag export.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.2 https://github.com/thalesgroup-cert/Watcher.git
    # already have the repo? check out this version:
    $ git checkout v1.2.2

    • ENABLE_CERTSTREAM=true in .env to enable real-time CT log stream integration for new domain detection
    • THEHIVE_TAGS and MISP_TAGS keys in .env to configure tags appended when exporting alerts to TheHive or MISP
    • Support for verifying LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. server certificates via the .env configuration

    3 details in Everything

18. v1.1.1 Jul 28, 2021 · release notes

    Watcher v1.1.1 adds split monitoring choice, default User Groups via populate_db, and TheHive API 1.8.1 support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.1 https://github.com/thalesgroup-cert/Watcher.git
    # already have the repo? check out this version:
    $ git checkout v1.1.1

    • Add split monitoring choosing option
    • Add default User Groups when using populate_db script
    • Support the new 1.8.1 TheHive Python API (thehive4py)

    3 details in Everything