Project
Watchtower: WRAVEN's public threat intelligence platform
A public OpenCTI dashboard that WRAVEN uses for its investigations and reports.
What it does
Watchtower is WRAVEN's threat intelligence platform. It keeps indicators, vulnerabilities and attacker techniques in one connected graph.
Anyone can browse the public dashboard. Our analysts use it for every investigation and report, and it is a priceless tool for that work.
How it works
Watchtower runs OpenCTI, the open threat intelligence platform from Filigran. We host it ourselves with Docker. Connectors pull data from these sources:
- Abuse.ch ThreatFox
- Abuse.ch URLhaus
- CISA Known Exploited Vulnerabilities
- MITRE ATT&CK
- NIST CVE and CPE
Only the dashboard faces the internet. The connectors, search and storage services stay on the internal network.
I designed the dashboard and connected the data feeds for the deployment. The setup is on GitHub.
Who uses it
WRAVEN members use it to research threats and to write reports. Anyone can view the public dashboard at public.wraven.org.
Thanks
Thank you to Filigran, who build OpenCTI and gave WRAVEN an NFE license.