Common - Core Algorithm

Watcher.common.core.collect_observables(app_name, context_data)

Collect observables based on app and context data.

Watcher.common.core.generate_ref()

Generate unique ‘sourceRef’ for an alert.

Watcher.common.core.remove_html_tags(text)

Remove HTML tags from a string.

Watcher.common.core.send_app_specific_notifications(app_name, context_data, subscribers)

Send notifications based on app type (Slack, Citadel, TheHive, Email). Collect observables, format content, and send to respective channels.

Watcher.common.core.send_app_specific_notifications_group(app_name, context_data, subscribers)

Send group notifications based on app type (Slack, Citadel, Email).

Watcher.common.core.send_only_thehive_notifications(app_name, context_data, subscribers)

Send notifications only to TheHive based on app type. Collect observables, format the notification content, and send them to respective channels.

Watcher.common.core.start_scheduler()
Launch multiple planning tasks in background:

  • Fire WHOIS discovery every 30 minute from Monday to Sunday

  • Fire Legitimate Domains RDAP/WHOIS every 30 minutes

  • Fire Monitored Sites RDAP/WHOIS every hour

  • Fire SSL certificate check every 6 hours

  • Fire Connectors health check every Monday at 06:00

Watcher.common.core.update_all_ssl_certificates()

Update SSL certificate information for all monitored sites.

Watcher.common.core.update_legitimate_domains_rdap_data()

Update RDAP/WHOIS data for legitimate domains.

Watcher.common.core.update_legitimate_domains_ssl_data()

Update SSL certificate expiry for all legitimate domains.

Runs every 6 hours via the scheduler (separate from the 2-minute RDAP job so SSL checks do not flood logs or timeout unnecessarily).

Watcher.common.core.update_monitored_sites_rdap_data()

Update RDAP/WHOIS data for monitored sites.