The Cloudflare Blog: Automating threat analysis and response with Cloudy

Aug 29, 2025

—

Source URL: https://blog.cloudflare.com/automating-threat-analysis-and-response-with-cloudy/
Source: The Cloudflare Blog
Title: Automating threat analysis and response with Cloudy

Feedly Summary: Cloudy now supercharges analytics investigations and Cloudforce One threat intelligence! Get instant insights from threat events and APIs on APTs, DDoS, cybercrime & more – powered by Workers AI.

AI Summary and Description: Yes

Summary: The text discusses the introduction of “Cloudy,” Cloudflare’s first AI agent aimed at enhancing security analytics. Through a conversational interface, it facilitates faster root cause analysis and threat identification by allowing users to query security databases in natural language. This innovation is designed to streamline threat detection and response, making it more accessible for security teams, especially those with limited resources.

Detailed Description:

– **Introduction of Cloudy**: Cloudflare has launched “Cloudy,” an AI agent integrated with security analytics functionality to assist in threat detection and response.
– **Challenge in Security Operations**: Security professionals are facing difficulties with the overwhelming amount of data, which complicates the identification of relevant threats amidst the noise.
– Need for rapid identification of threats in the case of suspicious traffic spikes.
– Limited capacity of lean security teams to analyze large volumes of logs and data.

– **Features of Cloudy**:
– **Conversational Interface**: Users can interact with the AI using natural language, allowing for more intuitive inquiries during security investigations.
– Example queries include focusing on specific endpoints and identifying known malicious IPs.
– **Faster Root Cause Analysis (RCA)**: Streamlines the investigative process from identifying issues to solutions.
– **Integration with Threat Intelligence**: Cloudy can access Cloudflare’s broader threat intelligence network for real-time information about emerging threats, including:
– Advanced Persistent Threats (APTs)
– Cybercrime activities
– Distributed Denial of Service (DDoS) attacks
– Various attack techniques and tactics.

– **User Adoption and Feedback**:
– The tool has seen significant adoption, with over 54,000 users experimenting with its features since its launch.
– Positive user feedback indicates that the tool is deemed insightful and valuable in simplifying complex data.

– **Capabilities of Cloudy**:
– Users can query for specific indicators of compromise (IOCs), threat actor progression, and emerging threats.
– Offers context-rich threat event data, interactive timelines, and mappings to attack techniques.

– **Future Developments**:
– Cloudflare plans to expand Cloudy’s functionalities, including intelligent debugging for web application firewall (WAF) rules and enhanced threat visualization capabilities.
– Continuous improvements aim to make Cloudy a pivotal tool for understanding and acting upon security incidents.

This innovation is particularly relevant for professionals in AI and security sectors as it enhances operational efficiency, improves threat visibility, and provides actionable insights, thereby addressing the critical challenges in modern security operations.

4 5 a access Act actionable insights adoption advanced advanced persistent threat advanced persistent threats age agent AI All analysis analytics and API APIs app Application art as at ated attack attack techniques attacks Auto Bi Bug by C capabilities capacity cause analysis challenge challenges CI CIA Cloud Cloudflare Cloudy co Context continuous continuous improvement conversation conversational crime critical cyber cybercrime D data database databases DDoS de Debugging denial Denial of Service design detection development developments DoS e efficiency emerging emerging threats end endpoint endpoints event exp face fast faster feature features feedback firewall first for function functionality future future developments g Gen gs H Helm HR http HTTPS in incident indicators indicators of compromise information innovation insights integration Intel intelligence inter interface investigation investigations io IoC IoCs IRS issue ite k l language large led Li line lm logs low M making mid ML Mode Modern modern security N natural language network no o of off on one ons operation operational operational efficiency operations OPM opt oS out over per point Power powered pro process professionals Progress ps Q queries R rate RCE re real real-time red resource resources response Ro Root Root Cause Analysis RSA s sec sector security security analytics security data security incident security incidents security investigations security operations security professionals security team security teams service Sig Sim solutions source specific SSE STIG T tactics team Teams tech techniques ted text the threat threat actor threat analysis threat detection threat identification threat intel threat intelligence threats Time time information to tool Tor TP traffic two UI under up US use user user adoption user feedback Users V val vents visibility visualization visualization capabilities web web app web application web application firewall Wi workers x yt z