Watchdog

The problem

Small teams run open-source security tools like Falco, Suricata, Wazuh and Zeek, and then drown in alerts. Most are noise, a few are serious, and nobody has time to read them all. This is called alert fatigue, and it's how real attacks get missed.

The insight

Detection tools are good at raising alarms and bad at explaining them. What's missing is the analyst in the middle who sorts, explains and acts.

What we built

A three-part platform. A lightweight Go daemon collects events from four detection tools. AI agents then remove duplicates, score each alert by confidence and explain what happened. A Next.js dashboard lets the team browse events. Watchdog also writes PDF incident reports, drafts new detection rules and summarizes a codebase's security posture. Setup is a guided terminal installer.

Under the hood

• Go (Bubbletea)
• Express 5
• TypeScript
• Prisma
• PostgreSQL 17
• Redis
• AWS S3
• Next.js 16
• Docker Compose
• Ollama

What it proves

We can design multi-service systems with real-time data, AI agents and infrastructure, not just front ends.