Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account
Cloudflare launched Threat Signals, a free service for all accounts that automates open-source threat intelligence ingestion. It uses agentic skills to summarize reports, extract indicators of compromise, and normalize data into private datasets. Users can apply these events directly to WAF policies. The platform also expands access to the Threat Events Platform for broader investigation and tagging.
Cloudflare released Threat Signals, a free capability that turns open‑source security reports into actionable intelligence for any Cloudflare account. The service watches RSS feeds, pulls each article into a private dataset, and runs agentic skills that summarize the text, extract indicators of compromise and apply tags. The resulting contextualized indicators are stored for up to 30 days and can be linked directly to WAF policies. In the same launch, Cloudflare also opened its Threat Events Platform to all accounts at no cost, letting users query the private datasets through an API or dashboard. Automating the conversion of unstructured reporting into normalized indicators removes a labor‑intensive step that historically required manual judgment, preserving the context that explains why a threat is relevant. By making this workflow available to every customer, organizations can scale threat‑intelligence expertise in the same way they scale infrastructure, improving the speed and consistency of defensive actions. The integration with WAF rules means that newly identified malicious domains, IPs or signatures can be blocked almost immediately, tightening protection for web applications. It remains unclear how well the default Cloudforce One‑defined skills will match the diverse taxonomies used by different security teams, a point highlighted by internal reviewers who cautioned against unfamiliar tagging vocabularies. The offering for Essentials, Advantage and Elite customers promises expanded RSS feed limits and custom skill creation, but the exact number of additional feeds and storage capacity has not been disclosed. Further, the long‑term reliability of the private datasets beyond the 30‑day retention window has not been independently verified.