Scroll to top
WATCHTOWER BY KNIGHTHAWK CYBERSECURITY

Turn Security Logs Into Threat Reports, Executive Summaries, and CMMC Evidence

Watchtower helps small businesses understand risk, explain it to leadership, and document next steps without adding another complex security platform or needing a dedicated security team.

13 supported log formats — auto-detected

MITRE ATT&CK mapped findings

Evidence-based threat scoring for CRITICAL and HIGH findings

Investigation steps and remediation guidance

AI-powered Q&A on every report

Per-user data isolation — your data stays yours

WHAT WATCHTOWER DOES

From Log File to Threat Report in Minutes

Built for small and midsize businesses that need visibility without hiring a full-time analyst. Watchtower takes the log files that live on your servers, firewalls, and endpoints — and turns them into structured, actionable threat intelligence without requiring a security analyst on staff.

Upload or Collect Logs

Upload a log file manually or configure automated collection on eligible business plans. Watchtower detects the log format automatically — no configuration required.

Analyze Suspicious Activity

Watchtower parses events, applies deterministic threat scoring for high-severity findings, and uses AI-assisted analysis to surface what matters — reducing noise and false confidence.

Generate a Structured Report

Every scan produces an executive summary, threat level score, detailed findings, and an event breakdown — formatted for both technical reviewers and business decision-makers.

Map to MITRE ATT&CK

Each finding is mapped to the MITRE ATT&CK framework — giving your team a recognized, consistent language to describe, investigate, and communicate threats.

Ask Follow-Up Questions

After every scan, the built-in AI Q&A lets you ask questions about your report in plain language — no security degree required to get a useful answer.

Track Over Time

All scans are stored in your account dashboard. Review previous reports, track how your security posture changes, and compare findings across time periods or environments.

WHERE WATCHTOWER FITS

Not an EDR. Not a Full MDR. Not Another Complex SIEM.

Watchtower is a security reporting and investigation layer. It helps your team understand the logs your systems already create, document risk, and turn findings into clear next steps.

HOW IT WORKS

Four Steps From Log to Action

1
Upload or Collect

Upload a log file from your device, or configure automated log collection for scheduled delivery.

2
Analyze

Watchtower detects the log type, parses events, applies threat scoring, and runs AI-assisted analysis.

3
Review Findings

Read the threat report — executive summary, findings, MITRE mapping, investigation steps, and remediation guidance.

4
Ask & Export

Ask follow-up questions using the built-in AI Q&A, then export or share the report as needed.

WHAT'S INSIDE EVERY REPORT

A Complete Picture, Not Just a Log Dump

Threat Level Score

A single CRITICAL / HIGH / MEDIUM / LOW / INFORMATIONAL score — computed deterministically for high-severity findings so it is never left to AI interpretation.

Executive Summary

A plain-language summary of what happened, how serious it is, and what to do about it — written for both technical staff and business stakeholders.

Detailed Findings

Each threat identified is listed with the evidence that supports it, the relevant log events, and a confidence level so you know what to prioritize.

MITRE ATT&CK Mapping

Every finding is mapped to a MITRE ATT&CK technique and tactic — giving your team a consistent framework for investigation and communication.

Investigation & Remediation Steps

Clear next steps for each finding — what to investigate, what to contain, and how to remediate. No vague alerts.

AI Q&A

Ask questions about the report in plain language — "what is the biggest risk?", "what should I do first?", "explain this event ID" — and get direct, useful answers.

CMMC READINESS

Turn Security Logs Into CMMC Readiness Evidence

Watchtower helps small businesses and defense contractors organize log-based security evidence for internal review, self-assessment preparation, and compliance documentation.

Reports can support visibility into access control, authentication activity, audit logging, system integrity, firewall activity, and suspicious security events.

Watchtower supports CMMC readiness and evidence organization. It does not replace a formal assessment, legal review, compliance consultant, or C3PAO certification.

  • Log source summary and date range reviewed
  • Security findings mapped to relevant control areas
  • Evidence tables for review and documentation
  • Executive summary for leadership
  • Remediation checklist for open findings
SUPPORTED LOG TYPES

13 Formats — Auto-Detected, No Configuration

Upload your log file and Watchtower identifies the format automatically. No manual selection, no pre-configuration, no format guides to follow.

Windows Event Log
CSV export — Event ID analysis, logon events, credential access
Linux Syslog
RFC3164 format — kernel, daemon, auth, and service events
OpenSSH Auth Log
Brute force detection, accepted logins, invalid users
macOS Log
System, kernel, and launchd events from macOS endpoints
Firewall Log
UFW and iptables — DROP/REJECT rules, port scanning, traffic anomalies
Web Server Access Log
Apache / Nginx combined log format — request analysis, scanning, exploitation attempts
Router Log
DHCP, admin login, UPnP, and WAN-side events
Apache Error Log
Error, warning, and notice events — injection attempts, brute force
Snort IDS Alerts
.fast and .full alert formats — priority, classification, trojan detection
Suricata eve.json
Structured JSON alert format — flow, DNS, HTTP, and alert events
Zeek DNS Log
DNS tunnelling detection, NXDOMAIN analysis, hex-encoded subdomains
Zeek DHCP Log
Rogue DHCP server detection, starvation attacks, MAC anomalies
Wireshark CSV Export
Packet capture analysis — port scanning, ARP storms, cleartext credentials
WHY WATCHTOWER

Clear Reporting. Practical Guidance. Built for Real Teams.

Clear Reporting

Reports are structured for both technical reviewers and business stakeholders — no translation required.

Practical Next Steps

Every finding includes what to investigate and how to remediate it — not just that something looks suspicious.

AI-Assisted Analysis

AI handles summarization, MITRE mapping, and Q&A. Deterministic logic handles scoring where precision matters most.

Built for Real Teams

Designed for individuals and small teams, yet powerful enough for larger environments. No weeks of training or tuning required to get value.

Watchtower pricing is based on log volume, report frequency, and evidence features — not endpoint count or technician seats.

Your First Scan Is Free

Create a free account and upload a log file. Get a full threat report — executive summary, MITRE mapping, investigation steps, remediation guidance, and AI Q&A — at no cost.