What this signal monitors
Real-time news monitoring for event security in SignalGuard's Chatter pillar is built on GDELT 2.0 — a global open-data project (Google Jigsaw plus university partners) that scrapes thousands of news outlets every 15 minutes and indexes events, themes, tone, and locations. We use GDELT's Document API to surface articles that mention your event keyword plus a threat-vocabulary OR-list (protest, unrest, riot, attack, shooting, bombing, threat, evacuation, terror, security, violence, arrest, incident), tone-scored so a wave of negative coverage is itself a signal even when no single headline is alarming.
Data sources
The news signal calls the GDELT DOC 2.0 API at https://api.gdeltproject.org/api/v2/doc/doc. SignalGuard's client constructs a query that combines your keyword, the threat vocab OR-group, and event name or location if provided, with sourcelang:english as the language filter. GDELT supports "exact phrase", implicit AND, and (a OR b OR c) operators — the client uses all three.
GDELT enforces approximately 1 query per 5 seconds per IP. SignalGuard adds an 8-second floor for shared-egress safety, serializes in-flight requests, caches responses for 30 minutes, and applies a sticky 10-minute cooldown after any 429 to recover cleanly from rate-limit episodes. News moves slowly enough that a 30-minute cache is a reasonable tradeoff between freshness and upstream pressure.
How SignalGuard scores severity
Per-article severity matches the article title against four tiers: critical (/\bshoot/, /\bterror/, /\bbomb/, /\bmass\s*shooting\b/, /\bhostage/); high (/\battack/, /\bstabb(?:ed|ing)\b/, /\briot/, /\bfatal/, /\bevacuat/, /\bkidnap/); medium (/\bprotest/, /\bunrest/, /\bclash/, /\barrest/, /\bthreat/, /\bsecurity\s+breach\b/); low (/\bcancel/, /\bdelay/, /\binvestigation/, /\bsuspici/). A tone-based bump escalates the overall corpus when GDELT's per-article tone average drops below -7 (high) or -4 (medium) on the roughly -10 to +10 scale. A volume bump escalates when many sources independently cover the same topic — a leading indicator that the story is breaking, not just trending.
Use cases for event security
Real-time news monitoring for event security catches editorial coverage of a stadium-area assault hours before social-media chatter sorts the story out. A 9pm local-news article reporting "two stabbed outside arena" appears in GDELT within ~15 minutes of publication and immediately classifies as high severity.
A festival operator running a multi-day event watches the news signal for trend escalation: even if no single headline crosses critical, a wave of medium-tone articles about adjacent unrest (protests in an adjacent neighborhood, a shooting elsewhere in the city) shifts the tone-bump and gets flagged to the duty officer.
A corporate-event security lead can preload a quarterly earnings date plus the company name and surface activist-investor coverage and protest-organizing news from the editorial side, complementing the social-side chatter signals.
Pairs well with
- X (Twitter) (
/docs/signals/x) — X is faster, GDELT is more authoritative; X often breaks a story, GDELT confirms it once outlets publish. - Reddit (
/docs/signals/reddit) — Reddit threads link to news articles; GDELT independently catches the same articles. Triangulation confirms the story is real. - FEMA disasters (
/docs/signals/fema) — when news coverage spikes for a city, FEMA declarations frequently follow within 24-72 hours.
Premium upgrade path
GDELT is free and open. Premium enrichment comes via the SignalGuard /integrations catalog: pair with Recorded Future, Flashpoint, or NewsAPI for higher-volume, lower-latency editorial coverage with deeper paywall coverage and full-text retrieval. The PredictHQ event-intelligence integration also adds attendance-prediction context to news items that mention competing events.
Frequently asked questions
Does real-time news monitoring for event security cover non-English sources?
The default GDELT query includes sourcelang:english. GDELT itself indexes ~100 languages; remove the language filter in custom configurations to broaden coverage. For events with international audiences, leaving English-only on but adding a translated keyword variant captures the right slice of non-English coverage.
How fresh is GDELT compared to news APIs like NewsAPI? GDELT re-scrapes the world's news every 15 minutes per the GDELT project documentation. That's slower than a paid push-API like NewsAPI (sub-minute) but vastly broader in source coverage and zero-cost. For event-security triage where minute-level latency rarely changes the operational call, the 15-minute tradeoff is the right one.
Why is the news signal sometimes empty for a recent event? GDELT requires editorial coverage to exist before it can index it. A breaking event in the first 15-30 minutes will show up on X and Bluesky long before GDELT catches it. This is expected behavior — the news signal is designed as the slower, more authoritative complement to the social chatter signals.
Can I monitor specific news outlets?
Yes, GDELT supports a domain: filter in its query syntax. Configure custom queries in the integrations panel to restrict coverage to e.g. domain:reuters.com OR domain:apnews.com. For most event-security use cases, the default broad-coverage setting catches the long tail more usefully.
==========