Cloudflare One Intel Turns Network Visibility into Actionable Security
Cloudflare has built its reputation on the breadth and speed of its global network, which now spans more than 200 cities and handles roughly 18 million HTTP requests and 6 million DNS requests every second. With over 1 billion unique IP addresses touching that network daily, and 72 billion cyberthreats blocked each day, the company holds one of the most comprehensive views of Internet activity available. That data, previously used to power products like Cloudflare Radar, is now being applied more directly to enterprise security with the introduction of Cloudflare One Intel.
Cloudflare One Intel is a new initiative designed to streamline network and security operations by converting the intelligence gathered from Cloudflare’s network into practical, actionable insights. The first two features released under this effort are DNS tunneling detection and domain insights, both available within Cloudflare Gateway.
Why Traditional Security Operations Are Slowing Teams Down
Many enterprises rely on a patchwork of point solutions to keep their corporate networks fast, available, and secure. Security teams typically dump logs from these tools into a SIEM and build custom alerts to catch incidents. Once a threat is spotted, the response cycle involves removing access controls, blocking malicious hostnames or URLs, and conducting investigations that pivot across DNS records, SSL certificate fingerprints, malware samples, and other indicators of compromise. The results are then fed back into block lists to prevent repeat attacks.
The problem is that these processes are fragmented. Threat intelligence platforms, SIEMs, and control planes are often separate systems, making detection, remediation, and forensics slow and expensive. Cloudflare One Intel aims to collapse these steps by uniting network activity data, global Internet threat insights, and automated policy enforcement into a single dashboard.
Detecting DNS Tunneling with Machine Learning
DNS tunneling is the practice of encoding data from another protocol inside DNS queries and responses. It is commonly used to slip past corporate firewalls to reach blocked sites, communicate with command-and-control servers, or exfiltrate sensitive data. Notably, not all DNS tunneling is malicious: some antivirus software relies on it to look up file signatures.
Cloudflare Gateway now includes a dedicated “DNS Tunneling” filter within its DNS filtering policies, available to all Gateway users at no extra cost. Administrators can enable it from the Policies section by selecting the “Security Threats” tab and checking the appropriate box. This automatically blocks requests to hostnames on the tunneling list; manual overrides are possible via Gateway’s “Domain Override” feature.
This new category replaces a broader “Anonymizer” grouping and goes beyond static blacklists. Cloudflare uses machine learning to analyze DNS request patterns across its network, flagging suspicious behavior every five minutes. Hostnames that exhibit anomalous activity are added to the list, with the notable exception of known benign tunneling traffic such as that produced by antivirus products. Because Cloudflare processes over 500 billion DNS requests daily, the model benefits from a highly global view of DNS traffic patterns.
Domain Insights Add Transparency to Gateway Logs
Cloudflare’s position atop vast streams of global traffic has long provided it with security intelligence, but that data has been difficult for users to interpret. Cloudflare One Intel is meant to change that. Now, administrators reviewing Gateway logs can quickly access detailed information on any allowed or blocked site.
By clicking a new “View Domain Insights” button next to log entries, users are taken to a detailed Cloudflare Radar Domain Insights page for that specific hostname. This feature is likewise included with all Gateway plans at no additional cost.
What’s Next for Cloudflare One Intel
The DNS tunneling detection and domain insights features represent the first wave of what Cloudflare One Intel will deliver. Cloudflare has indicated that additional features across the One platform are planned, including premium Radar options for Gateway customers. For now, Cloudflare Radar remains free for anyone to explore Internet trends, and Gateway users can begin blocking DNS tunneling attempts immediately through their account dashboard.
