Hi all,
I work in IT security, and at some point I got tired of piecing together the threat picture from twenty browser tabs every morning: Cloudflare Radar, abuse.ch, CISA KEV, ransomware leak sites, plus the advisories from CERTs and the security press. So I built a tool that puts all of it on one map. It's called Emberwatch and I run it as a Portainer stack.
The idea came from [ShadowBroker](https://github.com/BigBodyCobain/Shadowbroker), the OSINT dashboard that shows flights, ships, satellites, conflicts and a lot more on a world map. I loved it, but I wanted something focused purely on cyber that also keeps an eye on my own network. So Emberwatch isn't a fork. I took the idea and a bit of the look; the code is written from scratch.
What it does
There are four areas:
Cyber:world map with L7 attacks (origin → target), countries shaded by attack share, reported C2 servers, ransomware victims per country, internet outages, BGP hijacks and submarine cables. On the right there's "Matters today", which only shows what counts right now: alerts about my own assets, detected patterns and events that many sources report. Plus rankings and rule-based pattern detection (rising countries, spikes, new C2 families) that always tells you why it flagged something. No black box.
World:reports from government CERTs and security media (German BSI, NCSC UK, The Record, BleepingComputer, SecurityWeek, Krebs on Security, Golem). Emberwatch picks out countries, threat actors (via MISP Galaxy), malware, CVEs and the kind of incident, and draws origin → target on the map. Reports about the same event are grouped. Click one and you see it in context: what the local data says about it (KEV and EPSS for the CVE, active C2 servers for the malware, Cloudflare data for the country pair) and whether it touches my products or domains.
Analysis object pages for IPs, networks, AS numbers, domains, hashes, CVEs, countries, actors and more, with a risk rating and the reasons behind it. And a tool box: paste anything, Emberwatch detects the type and shows which tools fit. Ping and traceroute drawn live on the map, RDAP, BGP/RPKI, passive DNS, Certificate Transparency, TLS, HTTP header, SSH and mail security checks (SPF, DMARC, DKIM, MTA-STS), and mail header analysis. Every tool is labelled passive, active or intrusive, with whether the target sees you and which third party gets your input. For decoding there's a one-click jump into CyberChef.
My network watch your own IPs, networks, domains and products. Matched against C2 lists, ThreatFox, Spamhaus DROP, AbuseIPDB and Shodan InternetDB, plus CT logs, lookalike domains and live BGP via RIPE RIS. It tracks your home IP, and you can upload logs or send them via syslog. Alerts can go to Matrix.
Optionally, Gemini writes situation reports. For those the model only gets aggregated numbers and detected patterns: no assets, no IOCs, no logs. Single-item assessments only happen when you click the button.
Why Python
The backend is all Python (FastAPI, SQLite, one container). The reason is simple: Python is the only language I can really follow. For a tool that parses feeds from the internet and can scan ports, I wanted to understand what's going on. The frontend is plain HTML, CSS and JavaScript with MapLibre, no framework and no build step. You can't really do a browser UI without JavaScript.
Full disclosure: I'm not a trained developer. I built Emberwatch together with Claude (AI). The ideas, requirements and testing came from me.
Security
That's my day job, so it mattered to me:
.Container runs as an unprivileged user, read-only root filesystem, all capabilities dropped, no-new-privileges
* Login with scrypt-hashed password, signed session cookies, strict Content Security Policy, dynamic content only ever goes into the DOM as text
* Feeds are parsed with defusedxml, redirects only to HTTPS and public addresses
* Tools only reach public addresses by default; private and internal names are never sent to third parties
* Active scans only after explicit confirmation
What it isn't
* Cloudflare numbers are shares of the traffic Cloudflare sees, not absolute attack counts. Origin means where the attacking IPs are, not who's behind them.
* Recognition in the World view is rule-based and works on headlines and teasers. It can get things wrong. Attributions are statements made by the sources, not facts, and are shown that way.
* One user, one instance. Meant for homelab and personal use, not a SIEM replacement.
Licence and install
PolyForm Noncommercial: the source is public and free for personal and other non-commercial use. Strictly speaking that's not OSI open source, but several of the data sources (Cloudflare Radar is CC BY-NC, for example) only allow non-commercial use themselves.
There's a prebuilt image on GHCR that runs as a Portainer stack or with Docker Compose. Setup is in the README (English and German).
GitHub: https://github.com/SaturdayNetLab/Emberwatch
The screenshots show demo data with IPs from the documentation ranges, not my network.
Feedback is very welcome. I'd especially like to know which sources you're missing, and what you'd do differently with the recognition in the World view.
---
Gallery captions
- Cyber view: attacks, C2, ransomware and infrastructure on the map, "Matters today" on the right
- World view: reports from authorities and security media, origin → target taken from the reports
- A report in context: classification, the same event in other sources, the local data on it, does it concern me?
- Object page for a country: risk rating with reasons and history
- Tool box: paste an input, get the tools that fit, each labelled passive, active or intrusive
