How CACI's DarkBlue Uses Elasticsearch and Claude to Accelerate Dark Web Criminal Investigations

The dark web hosts illegal activities—drug trafficking, arms trading, ransomware sharing, human trafficking—worth over $4 billion. CACI is an international leader in dark web analysis. Its DarkBlue Intelligence Suite enables national security and intelligence teams to search open-source intelligence (OSINT) and unmask criminals operating on the dark web, with additional expansion to other open web sources hosting illicit activity.

Building a platform to search and analyze this volume of unstructured, constantly shifting data required infrastructure capable of ingesting diverse data sources at scale, delivering search results in seconds regardless of data age, and enabling clients to analyze data without exposing themselves to the dark web's inherent risks.

DarkBlue chose Elasticsearch and Elastic Observability as the core of its platform from the beginning. Running on AWS cloud with Elastic Agents and Fleet for data collection, DarkBlue can ingest structured and unstructured data from almost any source using schemas and templates set up once—without needing to build new software and connections for each. Kibana makes it easy to visualize and query large volumes of ingested data in real time. Filter functionality and keyword fields enable exact matching on targeted selectors, while Boolean operations, fuzzy matching, and full-text search allow investigators to explore data in the ways investigations demand. Elasticsearch also archives data indefinitely, enabling investigators to trace criminal personas that change identities over time.

The platform's newest capability, CluesAI, adds generative AI to the workflow. Harnessing Anthropic Claude LLMs via AWS Bedrock, CluesAI cross-references potentially identifying information across the dark web dataset maintained in Elasticsearch and generates automated intelligence reports—saving analysts and investigators countless hours of manually running down leads to deanonymize threat actors.

With DarkBlue, law enforcement clients can search for information without downloading a dark web browser or exposing themselves to malware or disturbing content. Searches complete in seconds regardless of the data's age or source. Seamless integration of new data sources—including leading crypto analyst firms added for cryptocurrency investigation—means the platform evolves alongside the dark web itself.

"Elastic's search and pivot capabilities allow us to connect the dots. We can often link anonymous personas to a single actor with just one query," said Cory Everington, Head of the DarkBlue Intelligence Suite.