Configurable system for detecting social media threats

1. A system for rule-based online threat detection comprising: a server comprising a rule cache and a processor; and

a computer-readable medium comprising instructions stored thereon which, when executed by the server, cause the server processor to execute a process operable to:

monitor a plurality of third-party data sources;

obtain, via a queueing service, a plurality of pieces of content from the plurality of third-party data sources; and

for each piece of content: fetch a rule ID from a user device based on the piece of content and a pre-selected setting on the user device by connecting to the user device via a rule application programming interface;

query the rule cache for the rule ID to identify a matching rule, the rule comprising a script, wherein the script comprises executable code;

extract the script for execution;

execute the script on the obtained piece of content to determine if the piece of content matches the rule; and

in response to executing the script, store a total number of executions of the script, a total number of execution errors for the script, and a total number of alerts generated for the rule in the rule cache; and

in response to determining that the piece of content matches the rule, send an alert to the user device.

2. The system of claim 1 , wherein the server comprises a plurality of server instances, each server instance being configured to run a number of executions and comprising a local rule cache.

3. The system of claim 1 , wherein monitoring the plurality of third-party data sources comprises:

receiving, from the user device, a selection of third-party data sources, wherein the selection was performed via a user input on the user device; and

obtaining, via the queueing service, the plurality of pieces of content from the selection of third-party data sources.

4. The system of claim 1 , wherein the processor is configured to:

receive, from the user device, a user input from a user associated with a protected entity;

configure the script based on the user input to create a parameterized rule;

prevent the parameterized rule from being used by entities other than the protected entity;

execute the configured script on a second obtained piece of content to determine if the second obtained piece of content matches the parameterized rule; and

in response to determining that the second obtained piece of content matches the parameterized rule, send a second alert to the user device.

5. The system of claim 4 , wherein the user input comprises at least one of:

a list of words to include in term-searching the second obtained piece of content;

a list of words to exclude from term-searching the second obtained piece of content; or

a numerical threshold for tuning a confidence level of the rule that triggers the alert to be generated.

6. A method for rule-based online threat detection comprising:

monitoring, by a processor of a server, a plurality of third-party data sources;

obtaining, by the processor and via a queueing service, a plurality of pieces of content from the plurality of third-party data sources; and

for each piece of content:

fetching, by the processor, a rule ID from a user device based on a third-party data source of the piece of content and a pre-selected setting on the user device by connecting to the user device via a rule application programming interface (API); querying a rule cache for the rule ID or identify a matching rule, the rule comprising a script, wherein the script comprises executable code;

extracting the script for execution;

executing, by the processor, the script on the obtained piece of content to determine if the piece of content matches the rule; and

in response to executing the script, storing, by the processor, a total number of executions of the script, a total number or execution errors for the script, and a total number of alerts generated for the rule in the rule cache; and

in response to determining that the piece of content matches the rule,

sending an alert to the user device.

7. The method of claim 6 , wherein sending the alert comprises:

executing, by the processor, a plurality of rules on the piece of content to determine if the content matches each rule individually;

analyzing the execution of the plurality of rules, wherein analyzing comprises using at least one of a Bayes network, a Monte Carlo method, or a custom grouping provided by the user device; and

in response to analyzing the execution of the plurality of rules, sending the alert to the user device.

8. The method of claim 6 , wherein monitoring the plurality of third-party data sources comprises:

receiving, by the processor and from the user device, a selection of third-party data sources, wherein the selection was performed via a user input on the user device; and

obtaining, by the server processor and via the queueing service, the plurality of pieces of content from the selection of third-party data sources.

9. The method of claim 6 comprising:

receiving, by the processor and from the user device, a user input from a user associated with a protected entity;

configuring, by the processor, the script based on the user input to create a parameterized rule;

preventing, by the processor, the parameterized rule from being used by entities other than the protected entity;

executing, by the processor, the configured script on a second obtained piece of content to determine if the second obtained piece of content matches the parameterized rule; and

in response to determining that the second obtained piece of content matches the parameterized rule, sending a second alert to the user device.

10. The method of claim 9 , wherein the user input comprises at least one of:

a list of words to include in term-searching the second obtained piece of content; or

a list of words to exclude from term-searching the second obtained piece of content.

11. The method of claim 9 , wherein the user input comprises a numerical threshold for tuning a confidence level of the rule that triggers the alert to be generated.