Security · SIH 2025 · prototype · 2025

WatchTower

Cyber incident reporting prototype built at Smart India Hackathon 2025. Reports are scored by an LLM with a rule-based fallback, matched against earlier incidents and escalated by risk. Grand Finale project.

Problem: Defence personnel had no single place to report a suspicious link, message or file and get it triaged.
What I built: A reporting portal and a FastAPI pipeline that scores each report, flags repeats, maps it to a region and escalates high-risk ones.
Outcome: Took the team to the SIH 2025 Grand Finale (8–9 Dec 2025). Hackathon prototype, not deployed.
Role: Team leader

Tech: React, TypeScript, FastAPI, Python, SQLite, Gemini API

Repository

What it is

WatchTower (also called Raksha Netra) is a cyber incident reporting portal for defence personnel. We built it at Smart India Hackathon 2025 for problem statement SIH25183. I was the team leader of Team Urban Dons, and we took it to the Grand Finale on 8 and 9 December 2025.

The idea is simple. Someone receives a suspicious link, message or file. They report it, and the system works out how risky it is and who needs to know.

It's a hackathon prototype. It isn't an official Ministry of Defence or CERT-Army service and was never deployed for real use. Government names in the screenshots are placeholders from the problem statement's theme.

What it does

Report. A reporter picks URL, message or file, adds optional notes, a location and voice input, and submits.
Analyse. The backend asks Google Gemini for a structured verdict: risk score, severity, threat type, indicators and recommendations. If the model isn't available, a rule-based fallback fills in the same fields. URLs also get a DNS lookup and a trusted-domain check, and files get a pattern-based static scan.
Add context. It looks for signs of fake officer profiles in messages, finds similar earlier incidents, maps the location to an Army command region, and escalates high-risk reports automatically.
Show. Admins get a dashboard, incident details, analytics and trends, in English and Hindi. Reporters only get a confirmation.

WatchTower admin dashboard showing incident counts and a table of sample incidents with severity, risk score and status

How it's built

It's two processes. A React single-page app (TypeScript, Vite, Tailwind, shadcn/ui, i18next) talks over HTTP to a FastAPI server on Python 3.11 with SQLite.

The analysis is a chain of small modules: URL checks, Gemini analysis with its fallback, file scanning, fake-profile detection, repeat-threat matching, region mapping and escalation.

Incident detail page for a sample phishing report, with the reported link, the AI analysis, threat indicators and a risk gauge reading 95

My part

I built the portal and the analysis pipeline, everything except the news-pulling feature, which a teammate wrote. The original repository sits on my teammate Chandan Kumar's account, and the early commits carry his name because I wrote that code on his laptop.

What's real and what's demo

It was built in hackathon time, so some screens are staged. The dashboard, analysis and detail screens show a fixed set of eight sample incidents. Real submissions are stored by the backend but don't show up there yet. The landing page statistics are placeholder copy. Gemini's risk scores are used as returned, with nothing checking their accuracy. File scanning is pattern matching, not a sandbox. Some planned modules were written but never wired in before the finale.

Security is prototype-grade and not hardened, which is one reason the source stays private. What does run end to end is the report form, the analysis pipeline, storage, and reading stored incidents back.