The Cloudflare Blog: Unleashing improved context for threat actor activity with our Cloudforce One threat events platform

Mar 18, 2025

—

Source URL: https://blog.cloudflare.com/threat-events-platform/
Source: The Cloudflare Blog
Title: Unleashing improved context for threat actor activity with our Cloudforce One threat events platform

Feedly Summary: Gain real-time insights with our new threat events platform. This tool empowers your cybersecurity defense with actionable intelligence to stay ahead of attacks and protect your critical assets.

AI Summary and Description: Yes

Summary: The text discusses the launch of a new threat events platform by Cloudflare designed for Cloudforce One customers, which enhances threat intelligence by providing contextual data about ongoing cyber threats. It emphasizes the platform’s ability to streamline the analysis of indicators of compromise and improve response strategies for cybersecurity professionals.

Detailed Description: The newly introduced threat events platform by Cloudflare represents a significant advancement in threat intelligence, aimed at improving the way organizations analyze and respond to cyber threats. Below are the key points and implications for professionals in security and compliance:

– **Contextual Threat Intelligence**: Unlike conventional indicator feeds that often lack context, this platform provides valuable details about observed threats, enabling organizations to understand not just the ‘what’, but also the ‘why’ behind indicators of compromise (IOCs).

– **Real-Time Monitoring**: The platform leverages Cloudflare’s extensive traffic insights, with capabilities to process 71 million HTTP requests per second and 44 million DNS queries per second, offering real-time views of threat activity.

– **Curated Event Streams**: The threat events platform curates cyber threat activities into actionable insights, which include:
– Not just IOCs, but also context about denial of service attacks and methods used by threat actors.
– Mapping threat activity to established frameworks such as MITRE ATT&CK and the Cyber Kill Chain to aid understanding and response.

– **User-Friendly Access**: Customers can interact with the platform through the Cloudflare Dashboard or API. Features like the Attacker Timelapse view and customizable filters allow users to explore specific threat activities and strategize defenses effectively.

– **Facilitates Investigation**: The platform aims to support security teams in investigating threats targeting their sectors, industries, or geographical regions. It poses critical questions, such as who is targeting them and how they can block these threats.

– **Collaboration and Sharing**: It enables secure sharing of datasets among trusted partners and the ability to control access for authorized users, enhancing collaborative cybersecurity efforts.

– **Future Enhancements**: Upcoming updates to the platform will provide more visualizations and analytics for better understanding of threat landscapes, thus allowing further integration with existing Security Information and Event Management (SIEM) platforms.

– **Proven Value**: Initial testing by a Fortune 20 threat intelligence team has ranked the threat events platform as the top source for threat intelligence, underscoring its novelty and relevance in providing actionable, unique insights.

The introduction of this platform marks a significant evolution in how organizations can leverage threat intelligence for enhanced cybersecurity, particularly for security and compliance professionals who rely on accurate and timely data to protect their assets and effectively respond to threats.

1 2 4 7 a access Act actionable insights advancement AI analysis analytics and API art as assets attack attacks board by C capabilities chain Cloud Cloudflare Col collaboration collaborative compliance compliance professionals Context control critical Customer customizable cyber Cyber Kill Chain cyber threat cyber threats cybersecurit Cybersecurity cybersecurity defense cybersecurity efforts Cybersecurity Professionals D dashboard data dataset datasets de defense defenses denial Denial of Service denial-of-service attacks design DNS e effective end event exp feature features for framework frameworks friendly future g Gen geo Go graph H HR http HTTPS implications in indicators of compromise information insights integration Intel intelligence inter investigation IoC IoCs J Just k Key l Labor land led Li low man management ML Monitor monitoring N no o of off on one organization organizations out phi platform platforms point Power pre process professionals question R rag Rank rate RCE real real-time real-time monitoring Region Regions response response strategies Ro RoT Rust s sec sector secure security security and compliance security efforts Security Information and Event Management (SIEM) security professionals security teams service SHA sharing SIEM Sig source specific SSE STIG T Tails Teams test Testing text the threat threat actor threat actors threat intel threat intelligence threat landscape threat landscapes threats Time time insights time monitoring to tool Tor TP traffic trie trust up update updates US use user user-friendly Users uth V val vents visualization visualizations Wi x