Cloudflare Threat Signals turns open-source threat blogs into WAF-ready intel — free

Cloudflare on Tuesday opened Threat Signals to every account at no charge, packaging agentic “skills” that turn open-source security reporting into summarized, tagged, indicator-rich threat events that can feed Web Application Firewall policies — without asking every shop to hire a full threat-intel desk.

The product monitors RSS feeds customers choose, pulls article text into clean markdown, then runs Cloudforce One–defined skills to summarize reports, normalize indicators of compromise and apply tags from each account’s own taxonomy. Outputs land in a private, account-scoped Threat Intelligence dataset retained for up to 30 days, with each indicator still linked to the original report so analysts can see why a domain or hash was flagged weeks later. Free tiers get one RSS feed plus API and dashboard access to the Threat Events Platform; Essentials, Advantage and Elite customers can add more feeds, proprietary Cloudforce One datasets, custom skills and richer WAF rule options.

Cloudflare’s bet is that discovery was never the hard part — RSS readers already surface research — but converting unstructured posts into consistent, trusted indicators at scale was. Early design choices reflect analyst pushback: AI tagging is limited to each account’s existing vocabulary, and the system records whether a tag was automatic or human-applied so trust can be audited.

For Canadian mid-market firms and public-sector agencies that already sit behind Cloudflare’s edge but cannot staff round-the-clock intel teams, Threat Signals lowers the floor for acting on the same open reporting the big banks buy. It will not replace proprietary feeds, but it makes “we read the blog and forgot to block the IOC” a thinner excuse.