01 / Scanner boundary
Start with a signed report.
The scanner owns discovery and host identification. WatcherBridge verifies the webhook signature and checks for duplicate deliveries.
- Event
- host.appeared
- Target
- 192.0.2.0/24
- Signature
- HMAC verified
Local network change review
What changed?
What needs
your attention?
WatcherBridge receives signed reports from your network scanner and turns them into prioritized briefings with evidence and a next check.
FIG. 01 / REPORT FLOWILLUSTRATIVE
01 / Architecture
Follow a report.
A scanner reports a host appearing on a sample network. Step through what happens from delivery to operator review.
Synthetic walkthrough
02 / Local storage
Keep the original evidence.
The bridge preserves the signed report in SQLite. Related reports can be grouped for a briefing while retaining their links to the original evidence.
- Storage
- Local SQLite
- Evidence
- Original signed report
- Identity
- Scanner-reported
03 / Optional AI
Explain the change.
Local rules set the priority floor. If configured, AI can explain the change using redacted context and may suggest a one-level increase up to high. A final leak check guards provider requests. If the model fails, the bridge stores a marked fallback.
When enabled, the AI investigator can use read-only tools to look up retained scanner reports about host history, services, and similar changes. The briefing can cite supporting evidence and show where lookups were incomplete.
- Example finding
- Scanner reported a host appearance
- Suggested check
- Confirm against your asset inventory
- Model context
- Redacted by default
04 / Operator decision
Review the evidence and act.
Open the briefing, check the saved report, and record your decision. Mark the change expected or unexpected, snooze it, or add a note.
- Evidence
- Linked in the briefing
- Example decision
- Expected change
- Decision storage
- Local to the bridge
02 / Review workflow
From report to decision.
Review what the scanner reported, see why it was prioritized, and record your decision in the local dashboard.
Review related changes
WatcherBridge groups qualifying appearance or disappearance reports into incidents. Optional AI summaries for closed incidents show how many briefings were sampled or omitted, label hypotheses, and can cite member briefings.
Approve review rules
By default, three matching, eligible “expected” decisions can trigger a rule proposal. An operator decides whether to approve it.
Check scanner coverage
See the Act, Review, or Quiet verdict beside each source’s coverage. A source’s liveness stays unknown until it sends a heartbeat.
03 / Try WatcherBridge
See it with a sample report.
The reviewer guide uses a synthetic sender. You can follow it without a network scanner.