Unleashing improved context for threat actor activity with our Cloudforce One threat events platform

From raw indicators to actionable threat context

Security teams face a familiar problem when working with indicator feeds: they get a list of IPs, domains, and hashes, but little or no detail about why those indicators matter. Most feeds only carry blockable indicators and can't represent more complex cases like CVE exploitation or insider activity. Long-form threat reports fill that gap, but they take time to write, edit, and publish — time defenders often don't have.

Cloudflare's new threat events platform for Cloudforce One customers is designed to close that gap. It draws on traffic across Cloudflare's network — an average of 71 million HTTP requests per second and 44 million DNS queries per second — and curates that activity into a stream of events that pair indicators of compromise (IOCs) with contextual data. The initial release covers denial-of-service attacks and advanced threat operations tracked by the Cloudforce One Intelligence team. Each event is mapped to the MITRE ATT&CK framework and cyber kill chain stages. Future releases will add events from the Web Application Firewall (WAF), Zero Trust Gateway, Email Security business email compromise detection, and other Cloudflare datasets.

Events are structured similarly to a STIX2 sighting object, with a summary, a detailed view, and framework mappings. Each event carries a unique identifier that links back to the underlying threat activity, so Cloudforce One analysts can provide additional context during follow-on investigations.

Built on Workers and Durable Objects

The platform is built on the Cloudflare Developer Platform. At its core is a Cloudflare Worker using SQLite-backed Durable Objects to store observed threat events. The team chose Durable Objects over D1, Cloudflare's serverless SQL database, because Durable Objects allow dynamic creation of SQL tables for uniquely customizable datasets. That design lets threat events scale across the network and stay resilient to surges in attack data. It also allows per-data-source control of events, letting Cloudflare share subsets of datasets with trusted partners or restrict access to authorized users only.

Metadata for each threat event lives in the Durable Object KV store, which can hold contextual data beyond the fixed, searchable fields — for example, requests-per-second for DoS events or sourcing information that lets analysts tie an event to the exact threat activity.

Two ways to work with threat events

Cloudforce One customers can access threat events either through the Security Center in the Cloudflare Dashboard or through the Cloudforce One threat events API. Both expose the same stream of activity and support user-defined filters.

• Attacker Timelapse view: A strategic overview in the dashboard for answering high-level questions about attacker behavior over time.
• Events table: A granular, filterable view for drilling into specific threat activity, adversary campaigns, and actionable IOCs. All data shown in the table is also accessible via the API.

As a real-world example, the platform includes events derived from the leaked chat logs of the Black Basta ransomware group. Analysts can filter the "Attacker" column by BlackBasta to get a curated list of verified IP addresses, domains, and file hashes tied to that group's infrastructure. More detail on Cloudflare's visibility into Black Basta is available in the research report on the leaked chats.

The platform is designed to help answer questions like:

• Who is targeting my industry vertical?
• Who is targeting my country?
• What indicators can I use to block attacks targeting my verticals?
• What has an adversary done across the kill chain over a given period?

Why publish threat events

The aim is to give analysts a self-serve way to explore ongoing threat activity through customizable filters, identify patterns, and respond before attacks escalate. In early validation, a Fortune 20 threat intelligence team tested the platform against 110 other sources and ranked it as their number one threat intelligence source, describing it as "very much a unicorn" in the space.

Planned enhancements include additional visualizations and analytics — attacker timelines, campaign overviews, and attack graphs — plus integrations with existing SIEM platforms and indicator sharing across systems.