Cloudflare's Threat Events now support STIX2!

Hey, it's me, shiichan! Today I found a Cloudflare Changelog update that should make life a little easier for security operations teams.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, Threat Events in the Security Center now support the STIX2 (Structured Threat Information Expression) format. This was a highly requested feature. Being able to export threat data in this industry-standard format makes it much easier to plug Cloudflare's threat intelligence into your existing security stack.

Why it matters

STIX2 is an industry-standard format for structuring threat information, things like indicators, sightings, and threat actors. Many Threat Intel Platforms (TIPs), SIEMs, and SOAR tools already speak this format, so it acts as a kind of common language across the security industry.

The flip side is: as long as a vendor only ships data in its own proprietary format, the receiving team has to build and maintain a custom parser just to consume it. It's a quiet but real ongoing burden.

What changes

The source highlights two concrete benefits:

• No more custom parsers: because STIX2 is widely supported, you get "out of the box" ingestion into major TIPs, SIEMs, and SOAR tools, so you don't need to build and maintain conversion code
• Clearer relationships: STIX2 gives a standardized way to represent relationships between indicators, sightings, and threat actors, so your analysts get a clearer picture of the threat landscape

In short, this update lets you integrate Cloudflare's threat events data more effectively into your existing security ecosystem.

Dive Deep

For the technical details on how to query events in this format, Cloudflare points you to its Threat Events API documentation. The changelog entry itself doesn't spell out the exact query parameter or which plans/endpoints support it, so you'll want to check the docs before implementing.

Wrap-up

• Cloudflare's Security Center Threat Events API now supports STIX2 output
• No more custom parsers: data can be ingested "out of the box" into TIPs, SIEMs, and SOAR tools
• Relationships between indicators, sightings, and threat actors are represented in a standardized way, making analysis easier

If you're a security or threat intel engineer wiring Cloudflare's threat data into your SIEM or SOAR, this is a quiet but genuinely useful update!