Watcher is an Elasticsearch feature for scheduled checks and automated actions. It lets administrators define conditions, evaluate them on a timer, and trigger responses such as alerts, scripts, or other workflows. In defensive use, this is helpful for monitoring cluster health, detecting configuration changes, and reacting quickly to suspicious events.
In security work, Watcher matters because automation can also be repurposed after compromise. A hostile operator who already has Elasticsearch access may use scheduled checks to verify whether users, API keys, or other access markers still exist, then recreate them if defenders remove them. That makes Watcher part of the persistence problem: even after a password reset, automated jobs or stored definitions may keep a foothold alive. Defenders should review Watcher rules alongside accounts, API keys, and snapshots when hunting for lingering access.