Cloudflare Launches Threat Signals: Agentic Skills for Open-Source Threat Intelligence, Free for All Accounts

Cloudflare has introduced Threat Signals, a new agentic skill set designed to automate the processing of open-source threat intelligence. Available to every Cloudflare account, the tool transforms unstructured research reports into structured security data by summarizing content, extracting indicators of compromise (IOCs), and applying consistent tags within a private, account-scoped dataset.

Automating Analyst Workflows

Threat Signals addresses the manual effort required to convert research posts into usable intelligence. The system uses RSS to monitor selected sources, fetching articles and converting them to markdown using Browser Run before storing them in R2. It then applies Cloudforce One-defined skills to:

• Summarize reports and identify key context.
• Extract and normalize IOCs (IPs, domains, hashes).
• Apply tags from the account’s existing catalog to maintain vocabulary consistency.
• Link the resulting Threat Event back to the original source report.

This ensures that indicators retain their context, allowing analysts to trace intelligence back to its origin.

Access and Integration

The extracted intelligence is stored in a private dataset and can be immediately applied to WAF policies to block malicious traffic. Cloudflare is also expanding access to the Threat Events Platform (part of Cloudforce One) to all accounts for free.

Free Tier Features:

• API and dashboard access to Threat Signals.
• Ability to add one RSS feed.
• API and dashboard access to the Threat Events Platform for investigation.

Enterprise Tier Features (Essentials, Advantage, Elite):

• Expanded number of RSS feeds.
• Access to Cloudforce One’s proprietary threat intelligence.
• Ability to create custom agentic skills.
• Creation of custom WAF rules from threat events.