Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account
Source
blog.cloudflare.com
Date
Key takeaways · AI-distilled
Cloudflare says the free tier includes one RSS feed, with the resulting private dataset kept for up to 30 days. Enterprise plans add more feeds, proprietary datasets, custom agentic skills, more storage and custom WAF rules.
The pipeline polls each feed in a Workflow, uses Browser Run to convert articles to markdown stored in R2, then runs an IOC extractor plus default Cloudforce One skills to summarize, tag and add context windowThe maximum amount of text a model can consider at once — its working memory for the current conversation or task.Full definition → per indicator.
Cloudflare restricted AI tagging to each account's existing tag catalog after teams said labels in an unfamiliar vocabulary were harder to use, since analysts would have two vocabularies to reconcile.
In Cloudflare's experience, analysts trusted automatic tagging more when the system recorded whether each tag was applied automatically or by an analyst, so they could see exactly what it had applied.
In early testing, analysts relied less on summaries than on the link between each event and its source report, which helped them track indicators and recall why each mattered. Cloudflare says the first version was a one-week internal prototype.
Terms in this piece · Glossary
context window — The maximum amount of text a model can consider at once — its working memory for the current conversation or task.
Why it matters
Applies AI skills to convert unstructured threat reports into structured, WAF-ready indicators. It is free on every Cloudflare account, so you can test it without extra cost.
