WatchTower

Overview

Most security tools stop at "here's an alert." WatchTower closes the loop: detection, investigation and containment in one console. It ingests raw HTTP access logs and scores every event causally, so only the past is ever visible. Six deterministic rules run alongside an Isolation Forest trained on history-relative behaviour, and neither signal is trusted alone. Alerts collapse into versioned incidents built from typed facts, each backed by a proof pointing at exact log lines. Claude reads that evidence and proposes hypotheses, but a validator checks every claim against the facts and rejects anything fabricated before it reaches the screen. Playbooks compile into containment actions whose targets are bound by code, not by the model: dry-run, approve, execute, verify against live traffic, roll back. Pull the AI out entirely and the system keeps working.

Key Features

• Ingested 180,800 log lines across 8 months at ~7,000 lines/sec with zero parse failures
• Reduced a month of traffic (22,982 events) to 3 incidents worth an analyst's time
• Causal, history-relative detection combining six deterministic rules with an Isolation Forest
• Versioned incidents built from typed facts, each backed by a proof pointing at exact log lines
• Claude-powered investigation with a validator that rejects any claim not grounded in the evidence
• Containment playbooks with dry-run, approval, execution, live verification and rollback
• 26x faster event paging (81 ms to 3 ms) and 2x faster analytics on TimescaleDB continuous aggregates
• Fully deterministic replay: runs are hashed by config, dataset and model
• Zero message brokers: Postgres is the event store, job queue and outbox via SKIP LOCKED
• 187 backend tests plus real-browser Playwright gates on every pull request