Cloudflare Launches Threat Signals to Automate Open-Source Threat Intelligence for All Accounts

Cloudflare Launches Threat Signals to Automate Open-Source Threat Intelligence for All Accounts Cloudflare has introduced Threat Signals, a free feature across all Cloudflare accounts that uses agentic AI skills to convert unstructured open-source threat reports from RSS feeds into contextualized, actionable indicators. Threat Signals extracts indicators of compromise (IOCs), summarizes reports, and creates Threat Events in private account-scoped datasets. Extracted indicators can be deployed directly into Cloudflare Web Application Firewall (WAF) policies. The system uses Cloudflare Workflows, Browser Run, and R2 to ingest feeds and applies AI tagging strictly constrained to an account's existing tag taxonomy. Access to the Cloudforce One Threat Events Platform is expanded to all accounts for free, with expanded feeds and custom skills available to enterprise tiers. Automating Unstructured Intelligence Ingestion Threat intelligence teams traditionally struggle with the manual effort required to parse unstructured research posts into usable indicators without losing essential context. Threat Signals automates this workflow using agentic skills—standardized instructions that replicate analyst procedures to summarize articles, surface key points, and extract normalized IOCs. Stored within a private Threat Intelligence dataset as Threat Events, these indicators can be applied directly to WAF rules. Alongside this launch, Cloudflare is extending free access to its Cloudforce One Threat Events Platform to all accounts, while enterprise tiers gain higher feed limits, proprietary data access, custom skills, and expanded storage. Technical Ingestion and Processing Pipeline Threat Signals monitors user-selected RSS feeds across RSS 2.0, Atom, and RSS 1.0/RDF formats to overcome scalability limits found in existing tools. Feeds are processed through Cloudflare Workflows, which periodically poll for updates and use Browser Run's Markdown quick action to convert articles into clean markdown stored in R2. Default Cloudforce One skills and an IOC extractor then process the text, tagging and contextualizing indicators while preserving a direct link between each indicator, its Threat Event, and the source report. Design Principles Centered on Analyst Trust Cloudflare developed Threat Signals to address analyst trust hurdles discovered during prototyping. Rather than allowing the AI to invent new categories, the system restricts automated tagging to an account's existing tag catalog to prevent vocabulary fragmentation. The platform also explicitly records whether tags were generated automatically or added by an analyst, and it maintains traceable links back to the original source article so defenders can verify the context behind blocked domains or addresses.

Cloudflare 推出 Threat Signals：面向所有账户免费开放开源情报 AI 处理功能 Cloudflare 宣布推出 Threat Signals 并向所有账户免费开放，利用 AI 代理技能自动化提取与分析开源威胁报告中的上下文及失陷指标。 Threat Signals 面向所有 Cloudflare 账户免费提供，支持通过 RSS 流监控开源情报并生成可用于 WAF 的威胁事件。 系统利用 Browser Run 与 R2 抓取并清洗文章，通过 Cloudforce One 技能提取 IOC、总结要点并打上结构化标签。 为确保分析师信任，AI 标签限定在用户既有词库范围内，并记录自动化与人工标记属性，全程保留原始报告链接。 企业版客户可扩展 RSS 订阅数量、接入 Cloudforce One 专有情报、生成自定义技能并获得更高存储与规则权限。 自动化开源威胁情报处理流程 Threat Signals 支持 RSS 2.0、Atom 和 RSS 1.0/RDF 规范。系统在工作流中通过 Browser Run 将订阅文章清洗为 Markdown 格式并存入 R2，再由 Cloudforce One 预设技能提取失陷指标（IOC）、生成要点摘要及打标。提取出的指标作为私有威胁事件（Threat Event）存储，可直接应用到 WAF 策略中。 提升分析师信任与上下文可追溯性 研发团队发现直接由 AI 自主发明标签会造成术语冲突，因此将 AI 标签限制在每个账户现有的标签目录内，并记录标签是系统自动应用还是人工添加。同时，提取的指标与原始报告保持长效关联，避免传统威胁情报平台中指标脱离上下文、导致后期无法评估风险的问题。 全员免费接入与企业级功能扩展 目前 Threat Signals 及 Cloudforce One 威胁事件平台已向所有 Cloudflare 账户免费提供，用户可通过 API 或控制台启用。Essentials、Advantage 和 Elite 企业客户还可扩充 RSS 监控数量、访问专有情报数据集、定制 AI 技能，并支持更高的存储空间与定制化 WAF 规则。

Organizations can now scale threat intelligence expertise the way they scale infrastructure. Threat intelligence analysts and network defenders have long automated the ingestion of structured threat feeds to help enrich their SIEM or WAF. The harder work has always been unstructured reporting: turning a research post into indicators your tools can use, without losing the context that explains why they matter. [AI skills](https://developers.cloudflare.com/docs-for-agents/#agent-skills) make that work possible to automate. A skill is a set of rich, detailed instructions that captures how an experienced analyst handles one part of the job, and it runs the same way on every report. Threat Signals puts that process into practice at scale. It’s launching today, and we made it available to every Cloudflare account. Threat Signals turns open-source reporting that you choose into intelligence you can act on. Its agentic skills summarize reports, surface key context, extract and normalize indicators of compromise, and apply tags — all within a private, account-scoped dataset. The end result is a contextualized indicator stored in your account’s private Threat Intelligence dataset as a [Threat Event](https://developers.cloudflare.com/security-center/cloudforce-one/#analyze-threat-events) that can instantly be applied in your [WAF](https://www.cloudflare.com/products/waf/) policy. Starting today, we are also expanding access to Cloudforce One’s [Threat Events Platform](https://blog.cloudflare.com/cloudflare-threat-intelligence-platform/), our core threat intelligence offering, to all Cloudflare accounts for free. With this expansion, each account gets: [Essentials, Advantage, and Elite](https://blog.cloudflare.com/cloudflare-threat-intelligence-platform/#from-data-management-to-active-hunting) enterprise customers can extend this offering to include an expanded number of RSS feeds, access to Cloudforce One’s proprietary threat intelligence datasets, the ability to generate custom agentic skills, higher storage options for Threat Signals’ derived open-source reporting, and the ability to create custom WAF rules on open-source and proprietary threat events. We started with open-source intelligence because it is the most obvious place to prove the power of agentic workflows. We also heard from customers that their existing platforms cannot scale beyond polling 100 RSS feeds. Recognizing the critical impact open-source reporting plays in understanding the threat landscape, we sought to build an infinitely scalable platform (more on that later). Researchers regularly publish detailed findings on vulnerabilities, malicious infrastructure, phishing campaigns, malware families, and threat actors. While RSS feed readers make it easier to discover new reporting, discovery is only the beginning. Harnessing data into a usable workflow with consistent expertise is the key to building actionable defense. Expertise has never been something organizations can replicate at scale. A report explains how a campaign works and identifies the infrastructure behind it, but before an analyst can use that information, they need to: Repeating that process across dozens of sources takes time; moreover, almost every step is entirely about human judgment. As a result, context is lost. Indicators inserted into your TIP are separated from the context that explains why they matter and helps assess the risk later in the remediation cycle. It's not surprising that weeks later, a domain is pushed to a blocklist and nobody understands why. Threat Signals uses RSS to monitor the open-source reporting that matters to your organization. You can add an RSS feed, give it a recognizable name and category, and configure how frequently Threat Signals checks for new content. All three feed specifications (RSS 2.0, Atom, and RSS 1.0/RDF) are supported. Each feed you select enters a [Workflow](https://www.cloudflare.com/products/workflows/) that periodically polls for new articles. It uses [Browser Run](https://developers.cloudflare.com/browser-run/)’s Markdown quick action to fetch and clean the article text into a readable markdown format, which is then stored in [R2](https://www.cloudflare.com/products/r2/). The text is passed into an indicator of compromise extractor and a set of default Cloudforce One-defined skills to summarize the content, apply tags based on your account configuration, and add indicator contextualization at the IOC level. The output is a concise summary and key points that help an analyst quickly understand what happened, who was affected, and why the report matters. All of it is searchable and tagged, so you can find the articles you care about across the platform. Lastly, each indicator extracted is backed by a threat event within the account's own private Threat Signals dataset. The event, its indicators and tags, and the original report stay connected, so an analyst can always trace where the intelligence came from and why it is there. These indicators can then be used to [create WAF rules from threat events](https://developers.cloudflare.com/changelog/post/2026-06-08-create-waf-rules-from-threat-events/) to protect your applications and infrastructure. It’s not hard to write a script that pulls an RSS feed and regexes IP addresses out of it. The first version of Threat Signals was a one-week internal prototype, built by a threat analyst who wanted more out of the reports she was already reading. Turning that into something every account can rely on was harder, and most of what slowed us down had nothing to do with parsing. The hard work was in making the output something analysts would trust and actually use. We were tempted to let the system invent whatever tags seemed useful. The teams we talked to pushed back: intelligence labeled in an unfamiliar vocabulary is harder to use, because now there are two vocabularies to reconcile. So we limited AI tagging to each account's existing tag catalog. Recording whether a tag was applied automatically or by an analyst sounds like a minor piece of metadata, but it turned out to be essential. In our experience, analysts were far more willing to trust automatic tagging when they could see exactly which tags it applied. Summaries are useful, and they are what users notice first. But what analysts kept returning to in early testing was the link between an event and the report it came from. As investigations progressed, we discovered that link consistently helped them keep track of indicators and understand why each one mattered in the first place. Open-source reporting isn’t limited to RSS feeds. Analysts need to be able to quickly consume threat intelligence in various formats and pipelines. Now that we’ve laid out the building blocks for ingesting indicators from data feeds into our platform, the natural next step is to add more consumers. Be on the lookout for more data ingestion pipelines that we will support so that you can bring more actionable intelligence onto the platform to protect your organization. The best investigations begin with trusted context, and Threat Signals helps keep that context close from the first lead onward. Threat Signals is now generally available for every Cloudflare account via API and the dashboard. Open the Cloudflare [dashboard](https://dash.cloudflare.com/login), navigate to Application Security → Threat Intelligence → Threat Signals, and add your RSS feed. [The documentation is here.](https://developers.cloudflare.com/api/resources/cloudforce_one/subresources/threat_signals/) You can also read [threat intelligence research](https://www.cloudflare.com/cloudforce-one/research/) from our team, and talk to your account team about putting Threat Events to work in your enterprise environment.