Cloudforce One launches RFIs and PIRs for structured threat intel

Cloudflare has made generally available two new tools for Cloudforce One customers: Requests for Information (RFIs) and Priority Intelligence Requirements (PIRs). Both are designed to help threat intelligence teams direct the Cloudforce One analysis team toward the specific threats and intelligence gaps that matter most to them, accessible through the Security Center dashboard or via API.

Requesting targeted analysis

RFIs provide a structured channel for submitting specific research queries directly into the Cloudforce One analysis queue. Customers can file requests categorized by threat, priority (routine, high, or urgent), and type—including binary analysis, indicator analysis, traffic analysis, threat detection signatures, passive DNS resolution, DDoS attack analysis, or vulnerability research. Expected output formats include malware analysis reports, indicators of compromise, or full threat research reports.

RFIs are built for teams inside Security Operations Centers, incident response teams, and threat research groups that need deeper visibility into attacks targeting their environments. The workflow includes:

  • Submission: Requests are filed through the RFI dashboard in Security Center.
  • Tracking: Customers can monitor status changes (open, in progress, pending, published, complete) and receive automated email or webhook alerts at each step.
  • Delivery: Completed responses are available for access or download from the dashboard.

Prioritizing intelligence gaps

PIRs offer a structured way to define intelligence requirements and organize them into categories aligned with organizational goals. A PIR signals to the Cloudforce One team which topics warrant deeper investigation, helping focus collection efforts on the most relevant insights for informed decision-making.

Looking ahead, Cloudflare intends to evolve PIRs from static requirement lists into dynamic tools that incorporate real-time intelligence from Cloudforce One. The goal is to connect ongoing threat intelligence directly to each predefined requirement, providing immediate, actionable context within the Cloudflare environment.

Building the investigation pipeline on Workers

Cloudforce One collaborated with Cloudflare's Security Incident Response Team (SIRT) and Trust and Safety (T&S) to track attacks against Cloudflare and abuse of its services. Those investigations exposed a need for a centralized platform to aggregate data and correlate reports from Cloudflare's unique vantage point on the Internet.

Rather than standing up a traditional stack of Postgres, Redis, and Ceph in a core data center, the team built the tooling on Cloudflare's own Workers and Pages platforms—serving as Customer Zero. File data is stored in R2, metadata in KV, and indexed data in D1. The threat investigation architecture comprises five services, four deployed at the edge and one in core data centers due to data dependency constraints.

  • RFIs & PIRs: API managing formal customer requests and priorities submitted via the Cloudflare Dashboard.
  • Threats: A Pages-deployed UI for interacting with all Cloudforce One services, internal tools, and customer-submitted RFIs and PIRs.
  • Cases: A case management system for storing analyst notes, IOCs, malware samples, and attack analytics. Each case is a Durable Object connected via WebSocket, with files and content persisted in Durable Object storage and searchable metadata in D1.
  • Leads: A queue of informal internal and external requests reviewed during threat hunting, with content in KV and metadata plus extracted IOCs in D1.
  • Binary DB: A raw binary warehouse for files encountered during investigations, including malware samples used for machine learning training. Files reside in R2 with metadata in KV.

Case management as Durable Objects

The core of the system is the case management service built on Workers and Durable Objects. The team needed a tool capable of storing forensic data, organizing it with Traffic Light Protocol (TLP) releasability codes, and linking analysis to existing RFIs or Leads—things collaborative documents weren't designed for.

Each case is a Durable Object accepting HTTP REST API or WebSocket connections. A WebSocket connection is added to the Durable Object's in-memory state, enabling real-time broadcast of events to all analysts viewing the case. Cases are broken into folders, each containing files with content, releasability information, and metadata. Storage keys are prefixed with the value type ("case", "folder", or "file") followed by a UUID, with each level storing references to its children.

This setup was used to track the RedAlerts attack before it was formalized into a public blog analysis.

Search and RAG for analysts

All case files are indexed as they are edited, enabling search across historical analysis. When a file is updated in the Durable Object, its content is pushed to Cloudflare Queues. A consumer then extracts and indexes indicators of compromise while also embedding the content into a vector and pushing it to Vectorize. Both indexes retain the case and file identifiers so results can be traced back to their source.

The team also implemented a full Retrieval Augmented Generation (RAG) workflow using Workers AI. Analysts can ask questions about previous analysis; the question undergoes the same processing as incoming content—IOC extraction and vector embedding—so results can be pulled from both the indicator index and Vectorize. The most relevant results are then passed to a text-generation model, which returns an answer to the analyst.

Availability

Cloudforce One customers can already access the PIR and RFI dashboards in Security Center or use the corresponding APIs. Documentation is available for the RFI API and the PIR API.