JA EN
shiichan

Threat Events API Connects Straight to Your SIEM with `format=taxii`!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hey everyone, it's me! Today I found a small but genuinely handy update that makes sharing threat intelligence a lot less painful.

Cloudflare Changelog developers.cloudflare.com

What was announced?

According to the Cloudflare Changelog, the Cloudforce One Threat Events API now supports TAXII as an output format. TAXII (Trusted Automated eXchange of Indicator Information) is an industry-standard format for automatically exchanging cyber threat intelligence between systems, and it's usually paired with STIX, the format used to describe the threat data itself.

The story so far

The Threat Events API already let you pull Cloudforce One's threat data, but the output used Cloudflare's own format. To feed that into your existing security stack, you'd typically need a custom translation script. That's a real friction point, because tools like these are usually built to expect a TAXII-formatted feed:

  • SIEM (Security Information and Event Management): a platform that aggregates logs and detection events for correlation analysis
  • TIP (Threat Intelligence Platform): a dedicated platform for collecting and managing threat indicators
  • SOAR (Security Orchestration, Automation and Response): tooling that automates the response after a detection

Whenever there's a mismatch with what those tools expect, you end up paying a translation tax.

What changes

Now you can just set the format parameter to taxii and stream Cloudforce One's threat data straight into your SIEM, TIP, or SOAR without writing a translation script. Updating blocklists and detection rules can be handed off to automated sync instead of manual work, which should meaningfully cut down on operational overhead. It also keeps your data consistent across different security products and partner integrations, which is easy to overlook but genuinely useful.

Dive Deep

The usage is refreshingly simple: just add taxii as the format query parameter when calling the Threat Events API.

GET /accounts/{account_id}/cloudforce_one/threat_events?format=taxii

That's it — the response switches to a TAXII-compliant format. The detailed parameter spec lives in Cloudflare's API Reference, so it's worth checking that too when you're wiring up a SIEM integration. One thing to keep in mind: since the Threat Events API is a Cloudforce One endpoint, you'll likely need a Cloudforce One subscription to use it.

Wrap-up

  • Cloudforce One's Threat Events API now supports TAXII-formatted output
  • Setting format=taxii lets you ingest data directly into SIEM, TIP, and SOAR tools
  • Blocklist and detection-rule syncing can now be automated, cutting the need for custom translation scripts
  • Data stays consistent across different security products and partner integrations

If your team already runs Cloudforce One and has been maintaining a homegrown script to bridge it with a SIEM or SOAR, this is a quiet but genuinely useful improvement.

Related posts