Cloudflare One now accepts third-party threat intelligence feeds
Cloudflare has announced new integrations that let customers bring threat intelligence from Mandiant, Recorded Future, and VirusTotal into the Cloudflare dashboard alongside Cloudflare One’s built-in threat data. The company says more partners will be added in the coming months.
Customers who subscribe to those vendors’ services can upload API keys to the Cloudflare Security Center. Once a key is active, the third-party data becomes available for use in rule builders across Cloudflare One products such as Gateway and Magic Firewall, as well as infrastructure security tools including the Web Application Firewall (WAF) and API Gateway. Search results in Security Center’s threat investigations portal are also automatically enriched with the licensed data.
Adding an API key
To connect a vendor account, navigate to Security Center → Reference Data, click the ellipsis next to the relevant row, and select “Edit API key.” After a valid key is entered, the status for that row changes from “No key provided” to “Active key.”
Mandiant
Mandiant Advantage customers with a Threat Intelligence subscription can use their API keys to pull Mandiant’s FQDN and IP address threat indicators—along with associated context—into Cloudflare One. The feeds are organized by threat category and include aggregations of the most active malicious infrastructure.
Cloudflare curates the data to emphasize recent activity and indicators relevant to infrastructure on the Cloudflare network, then imports and refreshes it on a schedule. The intelligence is available in Gateway, Magic Firewall, and WAF rule builders without requiring a different workflow.
"As cyber threats continue to rapidly evolve, organizations require up-to-date and relevant intelligence integrated with their preferred technology solutions to comprehensively protect their environments. Together, Mandiant and Cloudflare are enabling our mutual customers to better protect themselves from malicious actors that are active on the front lines right now.” — Robert Wallace, Senior Director, Strategy, Mandiant
Recorded Future
Recorded Future customers can upload their API key to enable Security Control Feeds in Cloudflare Gateway and Magic Firewall rule builders. Cloudflare surfaces only the intelligence that is actionable for the product being configured and updates the feeds automatically.
For instance, an administrator can create a rule that blocks connections where the source or destination IP appears in the Security Control feed “Command and Control - IP Addresses [Prevent].” That list refreshes daily for each customer with a valid key.
"As threats accelerate and converge in the world around us, Recorded Future and Cloudflare are working together to empower customers with the right intelligence at the right time, to keep our people and infrastructure safe.” — Craig Adams, Chief Product & Engineering Officer, Recorded Future
VirusTotal
VirusTotal Premium customers can add their API key to enrich Security Center’s Investigate tab. When querying an IP address, domain, or URL, a new card appears with VirusTotal’s summary of the object: last analysis verdict (e.g., harmless, suspicious, malicious), reputation score, tags, community votes, and the top files communicating with an IP address when applicable.
The current integration covers IPs, domains, and URLs; Cloudflare says support for additional object types, such as binary files, is planned.
"Cybersecurity teams face a challenging environment as attackers become more sophisticated. They need complete visibility and real-time threat intelligence from multiple sources to combat malicious threats. We are partnering with Cloudflare to help our mutual customers outsmart adversaries.” — Emiliano Martinez Contreras, Head of Product for VirusTotal — Google
Beta access
Access during the beta testing phase is available by request. Cloudflare is also accepting suggestions for additional data vendors to integrate, including customers’ own intelligence sources.
