https://cybertoolchain.io/tools/watcher New releases and features in Watcher, tracked by The Cyber Toolchain. en Mon, 19 Oct 2026 15:17:26 GMT https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.7.0 https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.7.0 Mon, 19 Oct 2026 15:17:26 GMT Watcher v3.7.0 adds bulk create and bulk actions across all modules, with new REST endpoints and configurable item limits.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `BULK_CREATE_MAX_ITEMS` and `BULK_ACTION_MAX_ITEMS` env vars to `.env` to cap bulk request sizes (both default to `200`; requests above the limit are rejected wholesale).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `POST <endpoint>/bulk_create/`, `bulk_update/`, and `bulk_delete/` endpoints to every module's API, each returning a per-item report of `created` / `skipped` / `errors`. • Adds `bulk_export_legitimate/` and `bulk_export_misp/` endpoints on `/api/site_monitoring/site/` to export selected suspicious domains to Legitimate Domains or MISP (one MISP event per site). • Adds a 'One item per line' bulk-add toggle to add forms for Legitimate Domains, Suspicious Domains, DNS Threats Monitored (domains and keywords), Data Leak search patterns, Banned Words, and Monitored Keywords. • Adds a Preview button on bulk-add forms to show what would be created without saving. • Adds bulk row actions to all tables — tick multiple rows to change legitimacy, takedown/legal-team/blocking requests, alert level, or status in one step, or delete them together. • Lists and dashboard statistics now refresh without a full page reload after bulk actions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/watcher https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.6.1 https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.6.1 Fri, 02 Oct 2026 15:23:30 GMT Watcher v3.6.1 adds a `?site=<id>` alert filter API and `/16` network memory for smarter Website Monitoring alerting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `?site=<id>` query parameter to the `/api/site_monitoring/alert/` endpoint to load alerts scoped to a specific monitored site.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `CERTSTREAM_VERSION` variable to Docker Compose and Helm chart to pin the `certstream-server-go` image version (currently `v1.8.2`). • Sets `SEARX_PATH=../Searx/searx` in `deployment/.env` to correctly point SearxNG at an existing `settings.yml` instead of generating a proxy-incompatible one. • CertStream keyword matching is now case-insensitive, and certificates without a subject CN are matched against their SAN list. • Adds a CertStream watchdog that resets silent connections and logs a `CertStream stats` line every 5 minutes. Breaking changes: • The `SEARX_PATH` default value has changed from `../Searx` to `../Searx/searx` in `deployment/.env.example`; deployments using the old value must update `deployment/.env` and remove any auto-generated `Searx/settings.yml`, then recreate the `searxng` container. • The `certstream` image is now pinned to `0rickyy0/certstream-server-go:v1.8.2` via the new `CERTSTREAM_VERSION` variable; Compose files that override the `certstream` image with `latest` will pull v1.9/v1.10, which cannot stream behind an HTTP proxy. • Compose files that override the `watcher` environment must explicitly add `certstream` to `no_proxy`, or the CertStream WebSocket will be incorrectly routed through the corporate proxy. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/watcher https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.6.0 https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.6.0 Thu, 01 Oct 2026 17:02:55 GMT Watcher v3.6.0 adds a Subdomain Takeover detection engine, a unified DNS threats table via `/api/dns_finder/threats_monitored/`, and a Kubernetes Helm chart.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New `/api/dns_finder/threats_monitored/` endpoint serves a unified table merging dnstwist typosquats, Certificate Transparency keyword hits, and Subdomain Takeover findings in one view, with a `Source` filter (sub-filters: Fuzzer, Corporate Keyword, Provider) to narrow by origin.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • New Subdomain Takeover (dangling DNS) detection engine resolves CNAME chains for subdomains seen in CertStream and matches against 15 named takeover-able provider fingerprints (Amazon S3, Microsoft Azure Web App, GitHub Pages, Heroku, Netlify, Fastly, Shopify, Zendesk, Bitbucket, Ghost, Help Scout Docs, Pantheon, Surge.sh, Tumblr, UserVoice), confirmed via NXDOMAIN or HTTP signature probe. • New Helm chart under `kubernetes/watcher/` deploys Watcher, SearxNG, and CertStream with an optional Bitnami MySQL subchart, Ingress, migration Job, and secrets; settings available in `kubernetes/watcher/values.yaml`. • Subdomain takeover findings now trigger notifications via Slack, Citadel, TheHive, and Email with dedicated templates. • Comments of up to 300 characters can be added to any finding via the Edit modal. • Certificate issuer and SAN list are now captured for every CertStream keyword match and displayed in the threats table. • Export destination selector supports MISP, Legitimate Domains, and Website Monitoring for dnstwist/Certificate Transparency findings, and MISP and Website Monitoring for subdomain takeover findings. • Corporate proxy configured via `HTTP_PROXY` / `HTTPS_PROXY` in `deployment/.env` is now honoured by the Watcher backend; add internal service hostnames to `NO_PROXY` in `deployment/.env` to bypass the proxy for them. • Corporate DNS Asset detail modal now lists dangling subdomains found for a given Corporate DNS Asset on demand. • Timeline view merges the history of a detected domain and its alert into a single unified view. Breaking changes: • In `/api/dns_finder/alert/`, the `status` field is now a string (`pending`, `suspected`, `confirmed`, `resolved`, `false_positive`) instead of `true`/`false` — any external script or integration that reads or writes this field must be updated. • The database schema and data migrations applied by `make migrate` are not reversible — back up the database with `make backup` before upgrading. • The Watcher backend now reads `HTTP_PROXY` / `HTTPS_PROXY` from `deployment/.env` — if Watcher previously reached internal services (TheHive, MISP, SMTP relay, etc.) directly, add their hostnames to `NO_PROXY` in `deployment/.env` before running `make up` or those calls will be routed through the corporate proxy. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/watcher https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.5.2 https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.5.2 Wed, 22 Jul 2026 15:21:38 GMT Watcher v3.5.2 adds a Connectors dashboard for centralizing integrations, Fernet-encrypted credentials, and SSO auto-provisioning control. • New `/connectors` dashboard (superuser only) centralizes configuration, live overrides, and health-check testing for all external integrations (SMTP, Slack, TheHive, MISP, LDAP, OIDC, MISP, CertStream, SearxNG, CyberWatch, WIPO UDRP, MySQL). • Per-connector live connectivity tests report Healthy / Unhealthy / Not tested yet status alongside Configured / Incomplete / Disabled state. • Scheduled job automatically tests every connector each Monday at 06:00 and raises a Pending Action alert only for configured connectors that fail, without duplicating alerts on repeated failures. • Sensitive connector fields (passwords, tokens, API keys) are now encrypted at rest with Fernet; existing stored values are re-encrypted automatically on migration. • New `OIDC_CREATE_USER` setting lets admins restrict SSO login to pre-existing accounts, disabling auto-provisioning of new users on first login. • Added Server banner / X-Powered-By monitoring as a connector-backed check. • Added `connectors/contrib/_template` scaffold to accelerate building new connectors. • Quick-pick shortcut buttons (1 month / 3 months / 6 months / 1 year) added to Expiry Date, SSL Expiry Date, and End of Monitoring date pickers. Breaking changes: • This release includes database schema changes — run `python manage.py migrate` after updating or connector credential storage and new settings will not function correctly. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/watcher https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.5.0 https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.5.0 Tue, 30 Jun 2026 16:16:10 GMT Watcher v3.5.0 adds a Timeline audit trail, UDRP approval workflow, a reworked ThreatsWatcher dashboard, and auto-fit table pagination. • Adds a full Timeline audit trail module that records every create, update, and delete action across all Watcher modules, with per-object history panels, field-level diffs, and actor avatars visible in every table row. • New `/api/timeline/events/` endpoint lets practitioners query the full history of any tracked object by content type and object ID. • Introduces a PendingActions approval workflow for UDRP case transfers: when a case is marked 'won', a PendingAction is queued for admin review instead of automatically calling transfer_to_legitimate_domains(). • Adds API endpoints for listing, approving, and rejecting pending actions, secured by existing permission guards. • New `avatar_color` field on `UserProfile` automatically assigns a deterministic color to each user on first login, surfaced as color-coded initials throughout the UI. • ThreatsWatcher dashboard redesigned with a new `ResizableContainer` split-pane layout, a `WordSummary` AI summary panel alongside post URLs, and a draggable divider with `localStorage` persistence. • Removes Google Fonts CDN calls; all icon and font assets are now served locally, eliminating external network dependencies at page load. Breaking changes: • The new `timeline` Django app requires a database migration (`python manage.py migrate`) and must be present in `INSTALLED_APPS` with its URLs registered — pull the updated `settings.py` and `urls.py` or add them manually before starting the service. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/watcher https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.4.0 https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.4.0 Tue, 12 May 2026 16:11:15 GMT New CyberWatch threat intel module, OIDC auth, interactive map, KPI panels, and new API docs in Watcher v3.4.0 • Adds the `CYBER_WATCH_CVE_API_URL` environment variable to configure the CVE source endpoint. • Adds `CYBER_WATCH_RANSOMWARE_GROUPS_URL`, `CYBER_WATCH_RANSOMWARE_VICTIMS_URL`, and `CYBER_WATCH_RANSOMLOOK_*` environment variables for ransomware data sources. • Adds `LOGIN_MODE`, `OIDC_COMPANY_NAME`, `OIDC_RP_CLIENT_ID`, and `OIDC_RP_CLIENT_SECRET` configuration keys to control federated login behavior. • Adds the `/api/auth/oidc/callback/` endpoint for handling OIDC authentication responses. • Adds `/api/docs/` (Swagger UI) and `/api/schema/` (OpenAPI 3 JSON) endpoints for API documentation. • Adds `udrp_status` and `udrp_last_checked` fields to the Site model for UDRP case tracking. • Adds a new CyberWatch module with a standalone dashboard accessible from main navigation. • Adds KPI panels to all six modules via dedicated `/statistics/` API endpoints. • Adds an interactive world map in Threats Watcher powered by MapLibre GL for visualizing RSS sources and ransomware victims. • Enables drag-and-drop resizing of dashboard panels with layout persistence in `localStorage`. • Adds `/profile` route with theme picker and layout manager for user preferences. Breaking changes: • The `OIDC_ENABLED` environment variable has been removed; use `LOGIN_MODE` instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/watcher https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.3.1 https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.3.1 Mon, 27 Apr 2026 13:13:12 GMT Watcher v3.3.1 adds a modular Makefile-based deployment helper for simplified Docker setup. • Adds `deployment/` directory with `make` commands as a simplified method to deploy Watcher via Docker. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/watcher https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.3.0 https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.3.0 Wed, 18 Feb 2026 16:39:06 GMT Watcher v3.3.0 adds local CertStream server, SSL expiry tracking, and regex keyword matching. • Adds a `CERT_STREAM_URL` environment variable to configure the local WS endpoint for certificate transparency monitoring • Introduces the `certstream-config.yaml` file with `webserver`, `prometheus`, and WebSocket endpoint configuration keys • Adds new `LegitimateDomain.ssl_expiry`, `Site.ssl_expiry`, `Site.domain_created_at`, `Alert.new_ssl_expiry`, and `Alert.old_ssl_expiry` database fields for SSL certificate tracking • Adds an `is_regex` boolean field to the Keyword model to enable regex pattern matching instead of literal string matching • Migrates the search engine service from `searx` to `searxng` with corresponding container name and image updates Breaking changes: • The `searx` service in `docker-compose.yml` must be renamed to `searxng`; existing container names and hostnames referencing `searx` are invalid. • The `SEARX_COMMAND` environment variable is no longer used and may cause confusion if left in `.env`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/watcher https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.2.2 https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.2.2 Fri, 19 Dec 2025 16:13:53 GMT Adds Bluesky as a new threat intelligence source and refines source confidence classification. • Adds `Bluesky` as a supported external source for monitoring cybersecurity threats and industry buzz • Introduces refined **source confidence classification** to better reflect reliability and trust levels for ingested data Full history on Cyber Toolchain: https://cybertoolchain.io/tools/watcher https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.2.0 https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.2.0 Tue, 16 Dec 2025 15:29:53 GMT Adds pagination to API endpoints for Data Leak, Site Monitoring, DNS Finder and Legitimate Domains modules • `?page=<page>&page_size=<size>` query parameters now supported on Data Leak, Site Monitoring, DNS Finder and Legitimate Domains API endpoints with configurable `page_size` (1–1000, default 100) • Threats Watcher article lists now support pagination via the same page/page_size parameters Full history on Cyber Toolchain: https://cybertoolchain.io/tools/watcher https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.0 https://github.com/thalesgroup-cert/Watcher/releases/tag/v3.0 Mon, 03 Nov 2025 15:01:33 GMT Watcher v3.0 introduces Legitimate Domains module, AI threat summaries, RDAP discovery, and configurable weekly/breaking news settings • Adds `LegitimateDomain` module with dedicated API for CRUD operations on company-approved domains • Adds `WEEKLY_SUMMARY_DAY`, `WEEKLY_SUMMARY_HOUR`, and `BREAKING_NEWS_THRESHOLD` to `.env` for controlling report schedules and alert thresholds • Adds RDAP alert support for tracking registration changes via the new `RDAPDiscovery` class • Adds Hugging Face transformers integration for AI-driven NER and text summarization in threat reports • Adds `ResizableContainer` and `TableManager` components for customizable dashboard panel widths, filtering, sorting, and pagination Breaking changes: • Major database schema changes require running `python manage.py migrate` after pulling the new Docker image to prevent data loss Full history on Cyber Toolchain: https://cybertoolchain.io/tools/watcher https://github.com/thalesgroup-cert/Watcher/releases/tag/v2.4 https://github.com/thalesgroup-cert/Watcher/releases/tag/v2.4 Thu, 31 Jul 2025 13:53:08 GMT Watcher v2.4 adds reliability scoring via `confident` column in `sources.csv`, BERT-based NER for entity detection, and a refactored 30-day trending algorithm. • Adds a `confident` field to `sources.csv` (values: 1 = 100%, 2 = 50%, 3 = 20%) to weight source reliability. • Switches entity extraction engine from previous implementation to `BERT-base-NER` for improved detection in news titles. • Changes the trending calculation window to only consider headlines from the last 30 days, preventing old surges from dominating trends. • Adds a 'Reliability %' column to the Watcher UI table to display the averaged confidence score of sources for each trending word. • Reduces the minimum occurrence threshold for trend detection from 7 to 5 (configurable in `settings.py`). • The update procedure requires manual deletion of `Source`, `BannedWord`, and `TrendyWord` database tables before running migrations to prevent conflicts with new fields. Breaking changes: • `sources.csv` now requires a `confident` column; missing this field will result in incorrect reliability scoring or processing errors. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/watcher https://github.com/thalesgroup-cert/Watcher/releases/tag/v2.1.1 https://github.com/thalesgroup-cert/Watcher/releases/tag/v2.1.1 Wed, 12 Feb 2025 10:07:15 GMT Watcher v2.1.1 adds automatic subdomain ingestion into TheHive cases from Website Monitoring DNS Finder alerts. • Adds `Website Monitoring` integration with `DNS Finder` to automatically feed parent domain cases/alerts with discovered subdomains. • Refines TLP, PAP, Severity, and observable tags for improved classification and response accuracy in TheHive. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/watcher https://github.com/thalesgroup-cert/Watcher/releases/tag/v2.1 https://github.com/thalesgroup-cert/Watcher/releases/tag/v2.1 Thu, 09 Jan 2025 13:08:29 GMT Watcher v2.1 introduces TheHive, Citadel, and Slack notification integrations plus SMTPS email support. • `SMTPS` replaces SMTP for email notifications to enhance transport security. • The `TheHive` integration enables automatic alert creation via TheHive APIs. • The `Citadel` integration delivers notifications through the Citadel enterprise application APIs. • `Slack` notifications are now supported, allowing direct delivery via Slack APIs. Breaking changes: • Email notifications now require SMTPS; existing SMTP configurations will fail without updating the `SMTPS` endpoint/credentials in `.env`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/watcher https://github.com/thalesgroup-cert/Watcher/releases/tag/v2.0 https://github.com/thalesgroup-cert/Watcher/releases/tag/v2.0 Wed, 14 Aug 2024 15:50:56 GMT Watcher v2.0 adds API key management for granular access control and replaces RSS-Bridge with new sources • `populate_db` command to ingest over 200 new cybersecurity RSS sources • Administrative capability to create one or more API keys per user Breaking changes: • The `rss-bridge` container has been removed; delete it from your `docker-compose.yml` file • MySQL versions >= 8.2.X are incompatible with Watcher and may impair its functionality • RSS sources associated with the old RSS-Bridge setup are obsolete and can be deleted Full history on Cyber Toolchain: https://cybertoolchain.io/tools/watcher