Cloudflare Launches Threat Signals for RSS-Based Threat Intelligence
Summary
Cloudflare launched Threat Signals for all accounts, using agentic skills to summarize selected RSS reporting, extract and contextualize indicators, and store linked threat events in a private dataset for investigation and WAF use.
Key points
- Threat Signals is available through the API and dashboard to all Cloudflare accounts.
- The service monitors selected RSS feeds and supports RSS 2.0, Atom, and RSS 1.0/RDF.
- It summarizes articles, extracts and normalizes indicators of compromise, and applies tags from an account’s existing tag catalog.
- Each extracted indicator is linked to its source report and stored with tags as a threat event in an account-scoped dataset, retained for up to 30 days.
- Users can investigate events through the Threat Events Platform and apply indicators in WAF policies.
- Enterprise customers can add RSS feeds, access Cloudforce One proprietary threat intelligence, create custom skills, and use additional storage and WAF rule options.
Article Details
- Event Type
- Cloudflare launched Threat Signals and made it generally available to every Cloudflare account via API and dashboard, alongside free access to the Threat Events Platform.
- Impact
- Threat Signals processes selected RSS reporting to summarize articles, extract and contextualize indicators, apply account-defined tags, and store linked threat events in a private dataset for up to 30 days. The indicators can be used in WAF policies. Essentials, Advantage, and Elite enterprise customers can add expanded feed capacity, proprietary threat intelligence datasets, custom agentic skills, more storage, and custom WAF rules.
Vendors
Products
Cloudforce OneStarting today, we are also expanding access to Cloudforce One’s Threat Events Platform, our core threat intelligence offering, to all Cloudflare accounts for free. With this expansion, each account gets:R2quick action to fetch and clean the article text into a readable markdown format, which is then stored in R2. The text is passed into an indicator of compromise extractor and a set of default Cloudforce One-definedThreat Events PlatformStarting today, we are also expanding access to Cloudforce One’s Threat Events Platform, our core threat intelligence offering, to all Cloudflare accounts for free. With this expansion, each account gets:Threat SignalsThreat Signals puts that process into practice at scale. It’s launching today, and we made it available to every Cloudflare account.