Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account
- ID
- 29817
- Status
- summarized
- Published
- 29 Sep 2026, 9:00 PM
- Fetched
- 29 Sep 2026, 10:55 PM
- Provider
- Cloudflare Blog
- Category
- infrastructure
- Original URL
- https://blog.cloudflare.com/threat-signals/
- Source URL
- https://blog.cloudflare.com/rss/
Summary
- Score
- 6.5
- Created
- 29 Sep 2026, 10:55 PM
- Tags
- Audience
- developersai_ml_learnersai_agent_userssaas_founders
What happened
Cloudflare launched Threat Signals, a set of "agentic skills" that turn open-source threat reports (starting with one RSS feed) into normalized indicators of compromise stored in a private, account-scoped dataset retained for up to 30 days, with API and dashboard access. It is free for every Cloudflare account, and Cloudflare also expanded its Cloudforce One Threat Events Platform to all accounts at no cost. Paid Essentials, Advantage and Elite tiers add more RSS feeds, Cloudforce One proprietary datasets, custom agentic skills, more storage, and custom WAF rules on both open-source and proprietary threat events.
Why it matters
If you already run Cloudflare, you can now wire one RSS feed into extracted, tagged IOCs and push them into WAF policy without paying — but the free tier is capped at a single feed and 30-day retention, so it is a way to test the agentic-skill workflow rather than replace a paid threat-intel pipeline. The more transferable idea is the packaging itself: Cloudflare encodes an analyst's workflow as reusable instructions that run identically on every report, and notes customers said existing platforms break past roughly 100 polled RSS feeds — a useful benchmark if you are building your own feed-ingestion or enrichment agents.
Discussion angle
Are "agentic skills" — fixed instruction sets that run the same way on every input — a better fit than general-purpose prompting for repetitive enrichment pipelines, and what breaks when you try to scale past the 100-RSS-feed ceiling Cloudflare says customers hit?