Watchtower

A distributed, event-driven cybersecurity simulation platform built with Flask, Apache Kafka, and Docker.

---

Overview

Watchtower simulates real-time interactions between system entities — including attackers, victims, and monitoring agents — using an event-driven architecture.

It is designed to:

• Model adversarial behavior in distributed systems
• Demonstrate real-time event streaming
• Enable scalable system monitoring and analysis

---

Components

Flask Backend

• Central orchestration layer
• Handles API requests
• Produces and consumes Kafka events

Kafka

• Distributed message broker
• Enables asynchronous communication
• Decouples services

Agent Container

• Monitors system activity
• Processes events
• Detects anomalies

Victim Container

• Simulates a target system
• Generates normal behavior
• Responds to incoming events

Attacker Container

• Simulates malicious activity
• Produces attack events

---

Dockerized Setup

All services are containerized using Docker and orchestrated via Docker Compose.

Benefits:

• Consistent environments
• Easy setup and deployment
• Scalable architecture

---

Tech Stack

• Backend: Flask (Python)
• Streaming: Apache Kafka
• Containerization: Docker, Docker Compose
• Architecture: Event-driven microservices

---

Getting Started

1. Clone the Repository

bash git clone https://github.com/yourusername/watchtower.git cd watchtower

2. Start the System

bash docker-compose up --build

3. Access Backend

http://localhost:5000

---

Workflow

1. Attacker produces malicious events
2. Events are published to Kafka topics
3. Victim consumes and reacts
4. Agent monitors and analyzes activity
5. Backend coordinates and logs system behavior

---

Features

• Real-time event streaming with Kafka
• Modular microservices architecture
• Fully Dockerized environment
• Simulated attack detection workflows
• Scalable and extensible design

---