Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account
Source
blog.cloudflare.com
Date
Context
Cloudflare's Threat Signals turns selected security reporting into a searchable dataset while preserving the connection between an indicator and its source. Its launch account describes monitoring an RSS feed, fetching articles, summarizing them and extracting indicators such as suspicious domains and IP addresses. Each indicator stays attached to a threat event and the original report, so analysts can inspect why it was included. Automatic tags use the account's existing vocabulary and remain distinguishable from analyst-applied tags. The free offering includes one feed and up to 30 days of storage, giving analysts a bounded way to organize reporting without losing its context windowThe maximum amount of text a model can consider at once — its working memory for the current conversation or task.Full definition →.
Key takeaways · AI-distilled
Cloudflare says the free tier includes one RSS feed, with the resulting private dataset kept for up to 30 days. Enterprise plans add more feeds, proprietary datasets, custom agentic skills, more storage and custom WAF rules.
The pipeline polls each feed in a Workflow, uses Browser Run to convert articles to markdown stored in R2, then runs an IOC extractor plus default Cloudforce One skills to summarize, tag and add context per indicator.
Cloudflare restricted AI tagging to each account's existing tag catalog after teams said labels in an unfamiliar vocabulary were harder to use, since analysts would have two vocabularies to reconcile.
In Cloudflare's experience, analysts trusted automatic tagging more when the system recorded whether each tag was applied automatically or by an analyst, so they could see exactly what it had applied.
In early testing, analysts relied less on summaries than on the link between each event and its source report, which helped them track indicators and recall why each mattered. Cloudflare says the first version was a one-week internal prototype.
Terms in this piece · Glossary
context window — The maximum amount of text a model can consider at once — its working memory for the current conversation or task.
