AWD-Watchdog
Defensive visibility for authorized Attack-Defense CTF rounds.
Case study: AWD-Watchdog
AWD-Watchdog is built for authorized Attack-Defense CTF environments where teams need fast visibility into who is hitting their box, which endpoint is under pressure, and whether service changes or outages need immediate action.
Problem it solves
In AWD rounds, teams often split attention between patching, checking service health, watching logs, and collecting evidence. This toolkit pulls those signals into one defensive workflow so decisions can happen faster.
Security use case
It supports defensive monitoring, alert triage, evidence collection, and patch guidance. It does not automate attacks or exploit other teams.
Key Features
Parses Suricata eve.json alerts, Apache/Nginx access logs, and optional Zeek http.log data.
Ranks source IPs, attacked HTTP paths, services, and likely vulnerability classes.
Watches web and service folders for suspicious file changes using inotifywait.
Runs HTTP/TCP health checks so the team can see service availability during a round.
Writes JSONL evidence and supports rotating tcpdump capture for post-round review.
Supports optional Discord or Telegram alerting for team coordination.
Tech Stack
Architecture and Workflow
- Collect network, web, and host signals from the challenge box.
- Classify activity such as SQL injection, command injection, traversal, upload abuse, or debug probing.
- Surface attacker IPs, target endpoints, and file-change evidence in the terminal dashboard.
- Use the alert context to patch, restart services, verify checkers, and improve rules.
How it helps during AWD
The dashboard view helps a team move from alert to action: identify the source IP, inspect the targeted endpoint, patch vulnerable logic, restart the service, confirm the checker still passes, and preserve evidence for review.
Future improvements
- Add richer web dashboard views for long-running competitions.
- Export evidence into SIEM-friendly formats.
- Expand competition playbooks and custom rule packs.
- Harden service deployment profiles for repeat team use.
Compare Work
Compare this tool with the wireless intrusion detection system project.
View Wireless IDS project