Security operations teams frequently face an overwhelming influx of security alerts, many of which turn out to be unrelated to their actual digital infrastructure. Sifting through millions of underground forum posts and leak sites to find genuine risks can exhaust valuable defensive resources. To address this challenge, Google Threat Intelligence has introduced the Relevance System, a feature powered by Gemini AI that aligns global dark web monitoring directly with your unique business profile.
The system operates by letting organizations explicitly define their digital landscape. Setting up the profile requires minimal effort, requiring only an organization name and a primary domain to begin. Once initialized, the platform maps key digital assets, such as specific IP ranges, company domains, and brand keywords. It also allows teams to prioritize monitoring for mentions from Initial Access Brokers, data leakers, insider threats, and VIP mentions across underground networks.
By understanding the unique footprint of your business, the underlying Relevance Engine automatically filters out noisy, non-relevant data. This automated triage drastically reduces alert fatigue and ensures that security analysts only spend time on high-fidelity findings. Every delivered alert contains a reasoned, plain-language summary detailing the threat actor's intent and specific risk vector. It also provides a transparent relevance analysis explaining the exact connection to your infrastructure, alongside direct access to the original source text, actor handles, and metadata. Furthermore, these contextualized alerts can be integrated directly into your existing SIEM or SOAR workflows via a robust API, allowing your enterprise to scale its defenses and respond to emerging threats with unprecedented speed and precision.
Additional Resources and Links:
GTIDocs: Getting Started with our new Dark Web Intel capabilities
GTIDocs: Relevance System API
