Microsoft, AWS, Google Cloud, OCI
Cloud resources, their configuration, and how they relate. Microsoft coverage includes Entra ID, Microsoft 365, Intune, and Azure, alongside AWS, Google Cloud, and Oracle Cloud Infrastructure (OCI).
Product
What WatchTower collects, and what you can do with it
WatchTower reads configuration from cloud tenants, Windows servers, and network and security devices, stores each version, and shows you what changed. Everything it collects is available in the app, in generated documentation, and to your AI tools over MCP.
Inventory and history
Browse resources and how they connect
Open any resource to see its current configuration, the resources it depends on, and every earlier version WatchTower has collected. Snapshots let you compare the whole environment at two points in time.
production-web-01
- Platform
- AWS · EC2 instance
- Network
- production-vpc / web-subnet
- Related resources
- Security group · IAM role · Volume
- History
- Current configuration + previous versions
Baselines and drift
Compare with an approved baseline
Approve a snapshot as your baseline, then review each change since: the attribute, the old value, and the new one. The assistant explains what a change does and cites the configuration it read.
− source: 10.20.0.0/16
+ source: 0.0.0.0/0
port: 443 · protocol: tcp
The allowed source expanded from an internal network to any IPv4 address. Review this change against the approved baseline.
Documentation
Documentation generated from collected configuration
Generate documentation from collected configuration, review it with your team, and regenerate it when the environment changes. Every version is kept, and you can export any of them.
Production environment
Network configuration
This section describes the captured network resources, access rules, and their relationships.
Changes since the previous version link back to the relevant configuration records.
Configuration references · Revision history · Export
Assistant and MCP
Ask in WatchTower or from your MCP client
Use the assistant in WatchTower, or connect Claude Code, Codex, or another MCP client. Both use the same tools and see only what your role in the organization allows.
MCP is included in the trial and every paid plan.
“Which resources depend on this network?”
“How does this firewall differ from its baseline?”
“Find the documentation for our production environment.”
Answers are limited to your organization and role.
Supported platforms
Cloud, Windows, network, and firewall configuration in one inventory.
Active Directory, Group Policy, servers
On-premises Windows configuration, collected by an agent you install on a server in your network and stored next to your cloud inventory.
Cisco, Palo Alto Networks, Fortinet
Cisco Catalyst, Nexus, and Meraki; Palo Alto Networks firewalls and Panorama; Fortinet FortiGate and FortiManager. Switch and firewall configuration gets the same history and documentation as everything else.