Threat Signals Arrives: Open-Source Threat Intelligence, Free for Every Cloudflare Account

Hi, it's Shii-chan!

Cloudflare Blog blog.cloudflare.com

Good news! Threat intelligence tooling is now available even to free Cloudflare accounts.

What was announced?

The Cloudflare Blog announced that Cloudforce One's Threat Events Platform is expanding to every Cloudflare account, along with a new feature called Threat Signals. Both are generally available and free through the API and dashboard.

• Threat Signals: automatically processes open-source threat reporting from RSS feeds, summarizes reports, surfaces key context, and extracts and normalizes indicators of compromise, keeping links to the original sources
• Threat Events Platform: the underlying platform for storing and investigating threat intelligence, where you can investigate events, indicators, and tags related to your private dataset

What changes

The work of reading threat reports and pulling out indicators by hand gets automated with AI skills. Each extracted indicator is backed by a threat event traceable to its original source, so you can see why it is there. That threat context also connects directly to your WAF policies to help protect your applications.

Dive Deep

Here is how it works. RSS feeds are monitored, articles are fetched and converted to markdown with Browser Run, and then processed by indicator extraction and summarization skills. The results are searchable and tagged.

Here are the differences between plans.

• Free (all accounts)
  • One RSS feed of your choice
  • 30-day data retention
  • Dashboard and API access to both services
• Enterprise (Essentials, Advantage, Elite)
  • Multiple RSS feeds
  • Access to proprietary Cloudforce One threat datasets
  • Custom agentic skill creation
  • Extended storage options
  • Custom WAF rule generation from threat events

Wrap-up

• The Threat Events Platform is now free for every Cloudflare account
• Threat Signals extracts and summarizes indicators from RSS threat reports automatically
• Free gets one RSS feed and 30-day retention, and Enterprise gets more
• Threat context can be tied to WAF rules

This is a great fit for small teams that want to use threat intelligence to run their WAF more smartly!