Skip to content
WatchTower15 Docs

Security scanning

Uptime tells you a service answered. Security posture tells you whether the things attackers exploit — an expiring certificate, a silently changed DNS record, a lapsing domain registration — are healthy. WatchTower15 monitors that posture continuously as part of the same outside-in check fleet, and turns findings into alarms your team can act on.

What’s checked today

Section titled “What’s checked today”
Area What WatchTower15 watches Why it matters
SSL/TLS certificates Validity dates, days-to-expiry, issuer, self-signed and chain-valid flags. An expired or broken chain is an instant outage and a trust failure.
DNS records & changes Full record set (A, AAAA, MX, TXT, CNAME, NS, SOA, CAA) with change detection between scans. An unexpected DNS change can mean a hijack, a misconfiguration, or an expired delegation.
Domain expiry Registration expiry, registrar and nameservers via WHOIS/RDAP. A lapsed registration is a catastrophic, entirely avoidable outage.
WHOIS / registrant changes Registrant and registrar detail, with change detection. A change to registrant or nameservers can be the first sign of a domain takeover.

Certificate health

Section titled “Certificate health”

The certificate check performs a live TLS handshake and extracts the chain — common name, issuer, validity window, computed days-to-expiry, and whether the certificate is self-signed or the chain fails to validate. When an endpoint isn’t directly reachable for a handshake, it falls back to public Certificate Transparency logs, so you retain certificate visibility even for hosts you can’t probe directly.

DNS & WHOIS change detection

Section titled “DNS & WHOIS change detection”

Every DNS and WHOIS scan is compared against the previous successful result and flagged when it changes, with the two scans linked so you can see exactly what moved and when. Transient resolver failures are classified as lookup_unavailable and excluded from change detection — so a flaky upstream never masquerades as a suspicious change.

Domain-expiry watch

Section titled “Domain-expiry watch”

Registration expiry is tracked daily. Paired with the Domain expiring soon alarm rule (warning at 60 days, critical at 30 by default, both tunable per domain), it turns the single most preventable outage into a calendar you can’t miss.

From finding to alert

Section titled “From finding to alert”

Security findings flow through the same alarm engine as everything else. The directly relevant built-in rules:

  • SSL certificate expiring soon — metric, warns then escalates as expiry nears.
  • Domain expiring soon — metric, same shape for registration.
  • DNS changed / WHOIS changed — boolean, warning-level heads-up on any change.

Attach a notification policy — ideally targeted at a tag like tier:public — and certificate and DNS posture is covered for every current and future domain that carries it.

On-host security scanning

Section titled “On-host security scanning”
Section titled “Related”