Security Operations Center (SOC) analysts work with both types of network intrusion detection systems (NIDS). These include signature based-NIDS (SNIDS) and ML/AI-based NIDS (MNIDS). User-studies involving SOCs highlight that false-alarms of SNIDS causes alert-fatigue to SOC analysts. User-studies focused on MNIDS highlight that although they are efficient in spotting malicious traffic, they have still not matured enough to be deployed in SoCs for providing benefits in realtime. Such benefits include specific attack classification in realtime, that help analysts prevent, mitigate or send appropriate responses for studying the attackers’ behaviour, via honeypots. Thus, keeping in mind the realtime deployability aspects which involve studying the effect of packet losses and attacks with varied speeds, we present Watson, a modular system that works in conjunction with a MNIDS. Watson classifies the traffic into specific attack classes and types, using its modules. We prototype and implement Watson for three threat classes, viz., password guessing attacks, active reconnaissance, and denial-of-service attacks. Collectively, Watson has modules covering 11 types of attacks with varying speed from 10Mbps to 10Gbps. We test Watson in-lab, using public datasets and on a live university network. It reported F1-scores of upto 0.98 and FPRs close to zero.