--- title: Introducing Threat Signals: agentic skills for... description: Cloudflare launched Threat Signals, a free feature for all Cloudflare accounts that uses AI agentic skills to automatically parse open-source threat... canonical: https://daily.dev/posts/introducing-threat-signals-agentic-skills-for-open-source-threat-intelligence-free-for-every-cloud-8godpsdi3 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account | daily.dev og:description: Cloudflare launched Threat Signals, a free feature for all Cloudflare accounts that uses AI agentic skills to automatically parse open-source threat... og:url: https://daily.dev/posts/introducing-threat-signals-agentic-skills-for-open-source-threat-intelligence-free-for-every-cloud-8godpsdi3 og:image: https://api.daily.dev/og/posts/8godPSdi3.png og:image:alt: Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account **[Cloudflare](https://daily.dev/sources/cloudflare)** · 7 min read · 0 upvotes · 0 comments ## Summary Cloudflare launched Threat Signals, a free feature for all Cloudflare accounts that uses AI agentic skills to automatically parse open-source threat intelligence reports from RSS feeds, extract and normalize indicators of compromise, summarize content, apply tags, and link indicators directly to WAF rule creation. The company is also expanding free access to its Cloudforce One Threat Events Platform, letting every account select one RSS feed and get a private threat dataset stored for 30 days. Paid Essentials, Advantage, and Elite tiers unlock more feeds, proprietary datasets, custom skills, and custom WAF rules. The post also shares lessons learned, such as limiting AI-generated tags to an account's existing taxonomy and the importance of preserving links between indicators and source reports. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does Cloudflare's Threat Signals feature do and how much does it cost? Threat Signals is a free feature for every Cloudflare account that automatically parses open-source threat reports from an RSS feed, extracts and normalizes indicators of compromise, summarizes content, and applies tags within a private, account-scoped dataset stored for up to 30 days. Extracted indicators can be turned directly into WAF rules. Paid Essentials, Advantage, and Elite tiers add more RSS feeds, proprietary Cloudforce One datasets, custom skills, and custom WAF rule creation. _Security teams tracking new AI-driven threat intel tooling can follow product rollouts like this on daily.dev._ ### How does Cloudflare's Threat Signals extract threat intelligence from RSS feeds? Each selected RSS feed enters a Cloudflare Workflow that periodically polls for new articles, using Browser Run's markdown quick action to fetch and clean article text, which is stored in R2. The text then passes through an indicator-of-compromise extractor and default Cloudforce One-defined AI skills that summarize content, apply account-configured tags, and add context at the indicator level, with each indicator linked back to a Threat Event and its source report. _Developers building or evaluating AI-driven security pipelines can track how tools like this evolve via daily.dev._ ## Similar posts on daily.dev - [Turning Cloudflare’s threat indicators into real-time WAF rules](https://daily.dev/posts/turning-cloudflare-s-threat-indicators-into-real-time-waf-rules-bzolpqo7d) · Cloudflare · 0 upvotes · 0 comments - [AI Security for Apps is now generally available](https://daily.dev/posts/ai-security-for-apps-is-now-generally-available-rf3xvcigf) · Cloudflare · 1 upvotes · 0 comments - [Cyber Talk-10 Cloudflare Built the Internet’s Immune System. Then It Turned on Itself.](https://daily.dev/posts/cyber-talk-10-cloudflare-built-the-internet-s-immune-system-then-it-turned-on-itself--yybicux0a) · Security Boulevard · 2 upvotes · 0 comments - [Are we ready to give AI agents the keys to the cloud? Cloudflare thinks so](https://daily.dev/posts/are-we-ready-to-give-ai-agents-the-keys-to-the-cloud-cloudflare-thinks-so-8cyuv29ee) · InfoWorld · 1 upvotes · 0 comments - [Cloudflare Processes 10M\+ Daily Insights with New Security Overview Dashboard](https://daily.dev/posts/cloudflare-processes-10m-daily-insights-with-new-security-overview-dashboard-2asrbn7n3) · InfoQ · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#cloudflare](https://daily.dev/tags/cloudflare) [View this post on daily.dev](https://daily.dev/posts/introducing-threat-signals-agentic-skills-for-open-source-threat-intelligence-free-for-every-cloud-8godpsdi3) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account","url":"https://daily.dev/posts/introducing-threat-signals-agentic-skills-for-open-source-threat-intelligence-free-for-every-cloud-8godpsdi3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introducing-threat-signals-agentic-skills-for-open-source-threat-intelligence-free-for-every-cloud-8godpsdi3"},"datePublished":"2026-09-29T13:06:41.936Z","dateModified":"2026-09-29T13:07:01.957Z","description":"Cloudflare launched Threat Signals, a free feature for all Cloudflare accounts that uses AI agentic skills to automatically parse open-source threat...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5d153348a009657052e6068ccc444013?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/5d153348a009657052e6068ccc444013?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Cloudflare","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Cloudflare","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/38522e1d11354cd6b7af66f9d4316735","url":"https://daily.dev/sources/cloudflare"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introducing-threat-signals-agentic-skills-for-open-source-threat-intelligence-free-for-every-cloud-8godpsdi3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,cloudflare","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Cloudflare","item":"https://daily.dev/sources/cloudflare"},{"@type":"ListItem","position":3,"name":"Introducing Threat Signals: agentic skills for open-source threat intelligence, free for every Cloudflare account"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/introducing-threat-signals-agentic-skills-for-open-source-threat-intelligence-free-for-every-cloud-8godpsdi3#faq","mainEntity":[{"@type":"Question","name":"What does Cloudflare's Threat Signals feature do and how much does it cost?","acceptedAnswer":{"@type":"Answer","text":"Threat Signals is a free feature for every Cloudflare account that automatically parses open-source threat reports from an RSS feed, extracts and normalizes indicators of compromise, summarizes content, and applies tags within a private, account-scoped dataset stored for up to 30 days. Extracted indicators can be turned directly into WAF rules. Paid Essentials, Advantage, and Elite tiers add more RSS feeds, proprietary Cloudforce One datasets, custom skills, and custom WAF rule creation. Security teams tracking new AI-driven threat intel tooling can follow product rollouts like this on daily.dev."}},{"@type":"Question","name":"How does Cloudflare's Threat Signals extract threat intelligence from RSS feeds?","acceptedAnswer":{"@type":"Answer","text":"Each selected RSS feed enters a Cloudflare Workflow that periodically polls for new articles, using Browser Run's markdown quick action to fetch and clean article text, which is stored in R2. The text then passes through an indicator-of-compromise extractor and default Cloudforce One-defined AI skills that summarize content, apply account-configured tags, and add context at the indicator level, with each indicator linked back to a Threat Event and its source report. Developers building or evaluating AI-driven security pipelines can track how tools like this evolve via daily.dev."}}]} ```