Threat Signals keeps extracted security indicators linked to their reports

Cloudflare’s Threat Signals turns selected RSS security reports into a private dataset of summaries, tags and indicators of compromise. Each indicator remains connected to its source report, so analysts can inspect why it was added. The system also distinguishes automatic tags from analyst tags and uses the account’s existing vocabulary instead of inventing a new taxonomy.

Cloudflare · Sep 29, 2026

Why it matters

Security teams can reduce ingestion work while retaining evidence behind each indicator.

More context

Try one trusted RSS feed through the dashboard or API. General availability includes one feed and up to thirty days of storage for every Cloudflare account. Expanded feeds, custom skills and some enforcement capabilities require enterprise offerings.

Keep in mind

AI extraction can be wrong or lose context. Review the original report before using an indicator in enforcement; 1min has not evaluated extraction accuracy.

Original read