• Adam Mikrut

Filtering the Noise of Ukraine Breaking News Tweets

Updated: Mar 8

This update is for customers that use DigitalStakeout Scout for corporate security or in a global security operations center (GSOC) setting.

Maintaining Situational Awareness During Geo Political Events


As the Russian-Ukraine conflict erupted, the situation saturated the news and online chatter. In the mix of this 24x7 information cycle, there is actionable information, disinformation, fake news, click-bait, and everything in between. How do you cut through the noise to focus on what matters to your mission and organizational needs?


A customer asked us to recommend a reliable and repeatable method that enables their organization to keep up with breaking news. They needed to maintain awareness of Ukraine's situation without being inundated with unverified information and unmanageable data volume. This blog details how we reduced the basic noise level to less than a tweet a minute.

Twitter as a Data Source for Real-time Critical Information

We focused solely on tapping into the Twitter firehose. Media organizations use Twitter to distribute breaking news and events. Journalists and organizations on the ground in key locations are tweeting about observations as they occur. Events and information on other social media platforms will rapidly distribute onto Twitter.


Using the DigitalStakeout Scout Twitter Firehose Monitor

The DigitalStakeout Scout Twitter Firehose Monitor enables users to create a real-time feed from the enterprise Twitter firehose. An advanced feature of this monitoring module is that it allows end-users to create a custom boolean "power rule." Creating a power rule enables customers to create a feed that matches Tweets based on fifty possible attributes about the type of Tweets you need to track.


After you toggle the power rule editor, this is the criteria you should use:


#breaking is:verified -is:retweet followers_count:10000 statuses_count:25000


How this Twitter Power Rule Works

  • The #breaking term is predominantly used on Twitter tag news worthy events.

  • is:verified means the Tweet must come from a verified account with a blue check.

  • -is:retweet means the Tweet is NOT a retweet. Only original posts will be streamed.

  • followers_count limits tweets to accounts with 10,000+ followers or more.

  • statuses_count limits matching tweets to a history 25,000+ tweets.

This combination of parameters creates a usable feed that is topical that has verified sources with a history of producing information to a larger amount of followers.

The Results the New Twitter Feed Produces


Using this power rule, we can reduce the raw stream of "breaking tweets" to approximately 35 tweets per minute down to 1 tweet per minute. As the figure of the DigitalStakeout Scout activity console shows, you now can filter your results to a manageable number of tweets to review or set alerts.



Once you have the feed streaming data, you can now take advantage of the many filtering features available to you in DigitalStakeout Scout.


  • Automated enrichment tags critical discoveries across five categories of risk.

  • Create auto-tagging rules to mark up important posts.

  • Boolean search and linked entity data enable you to pivot through the results.


Stay Aware of the Rapidly Changing News Cycle


Based on the severity of this dynamic situation, we recommend all DigitalStakeout customers create this feed or a variant of the rule in DigitalStakeout Scout. This continuous stream will enable you to maintain situational awareness of breaking news that can impact your employees, locations, or operations at any time.


If you need any help with this topic, please reach out to us, and a member of the team will help you as soon as possible.