Security event pipeline
Collect, validate, normalize, and query security events from systems and services.
OPEN SECURITY PLATFORM · IN DEVELOPMENT
See the signal.
Know the threat.
A modular Security Operations Center platform built to bring security events, detection engineering, investigations, and response into one place.
Open development · Built in milestones · Defensive security first
WATCHTOWER / OVERVIEW
SAMPLE DATASecurity posture · illustrative
EVENTS1,284Last 24 hours
OPEN ALERTS08Needs review
ENDPOINTS24Demo inventory
Recent detectionsSEVERITY
Repeated SSH authentication failures
Unusual process execution
New privileged account observed
EVENT VOLUME · MOCK VISUALIZATION
THE PLATFORM
One workspace. Multiple signals.
Watchtower is being developed as a connected defensive toolkit—not just a log viewer. Capabilities will arrive in tested, documented milestones.
Detection engineering
Build toward actionable rules, severity, alert lifecycle, and explainable detections.
Threat hunting
Search event timelines and connect activity into investigations with useful context.
Incident management
Organize findings, evidence, analyst notes, and response decisions in one workflow.
Endpoint & network visibility
Planned telemetry for Linux and Windows endpoints alongside network signals.
Threat intel & forensics
Build toward threat-intelligence enrichment, ATT&CK mapping, and investigation evidence.
INTERACTIVE PREVIEW
Explore sample events.
Try searching and filtering a small set of fictional security events. This demo runs in your browser and does not connect to a live backend.
Event explorer
Example telemetry · no real systems connected
| Event | Host / Source | Severity | Time (UTC) |
|---|
No sample events match those filters.
Showing sample eventsFictional data · illustrative only
BUILD IN PUBLIC
Built carefully. Milestone by milestone.
The public page is the starting point. The hosted multi-user service comes only after the backend is ready for it.
01 · COMPLETE
Foundation
API, normalized events, persistence, tests, and local development setup.
02 · CURRENT
Secure access
Account UI, workspace isolation, invitations, role checks, and audit trail. Deployment and migration hardening remain.
03 · PLANNED
Analyst workspace
Dashboard, detections, alert lifecycle, and incident investigations.
04 · PLANNED
Telemetry & response
Agent identity, endpoint data, enrichment, and controlled response workflows.
OPEN DEVELOPMENT
Help shape Watchtower.
Follow the code, review the roadmap, and track progress as the platform grows. The sign-in and account setup interface is published, but the API is not deployed and real authentication is not enabled yet.