Observed arrival · 2026-11-15
Watcher audits screens, shells and managed devices
Watcher is a self-hosted system for recording workstation screens, auditing console and SSH activity, and collecting telemetry from corporate Android devices.
- For
- Administrators investigating activity across managed devices
- Worth noticing
- Protected agents accept stop or removal commands only when signed by the server.
Field notes
Operators deploy a Linux server with Docker or systemd; agents buffer recordings locally and upload over HTTPS when connectivity returns. The console combines host timelines and searchable terminal sessions, with CSV/MP4 export and CEF/syslog audit logging. Documentation includes a “data-collected” page and says Android screen capture is optional and consent-based. The site also describes tamper-resistant agents that accept stop or removal commands only when signed by the server—a significant control in a workplace-monitoring system.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue