Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account

Cloudflare has launched Threat Signals, a generally available service that uses agentic AI skills to convert selected open-source threat intelligence RSS reports into actionable, contextualized indicators within each customer’s private Threat Intelligence dataset. The service monitors RSS 2.0, Atom, and RDF feeds, retrieves and cleans article content, summarizes reports, extracts and normalizes indicators of compromise, applies account-specific tags, and preserves links between indicators, threat events, and original sources so analysts can understand their relevance and provenance. These threat events can be investigated through the Threat Events Platform and used to create WAF policies, while all Cloudflare accounts receive free access to one RSS feed, 30 days of private derived data storage, and API and dashboard tools. Higher-tier enterprise customers can add more feeds, storage, proprietary Cloudforce One intelligence, custom AI skills, and custom WAF rules. Cloudflare emphasized that the system was designed to prioritize trusted outputs, familiar tagging vocabularies, transparency about automated tags, and retained source context, and it plans to support additional intelligence formats and ingestion pipelines beyond RSS.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.