Cloudflare Security Center opens up threat data for investigation
Cloudflare has historically trained its machine learning models and security products on the massive volume of attack data its network sees, but customers haven't had direct access to query that intelligence. That changes this week with the rollout of Investigate, a new threat investigations portal in the Cloudflare Security Center. The company plans to expand the tool to general availability next month, and will also begin annotating threat intelligence directly in its analytics dashboards.
The initial release of Investigate supports lookups on IP addresses and hostnames, with autonomous system (AS) details on the way later this week. That means you will be able to enter an IP from your logs and see which hostnames have pointed to it through DNS, check how a domain has been categorized from a threat perspective, or look up an AS to understand its reputation. Future iterations will add new data types, partner integrations that let you pull in threat data from existing licenses, and visibility into how your own infrastructure — including WAF rule hits, API Shield triggers, and employee DNS resolution attempts — has interacted with any object you research.
Contextual annotations in existing dashboards
Rather than forcing you to hop between a separate portal and your analytics, Cloudflare is baking threat intelligence directly into the pages where you already track security activity. The first integration is in web application firewall analytics. If you are investigating a spike in blocked requests triggered by a WAF rule, any relevant context about the source IP — such as whether it's a known anonymizer, Tor exit node, or cloud provider address — will display directly on the analytics page.
That extra context is meant to surface patterns that shift how you respond. A credential-stuffing attack originating from anonymizers points to a different mitigation than one from a single cloud VM IP, and seeing that in-line changes the follow-up questions you might ask about your bot management configuration.
What makes Cloudflare's view of the network different
The underlying data comes from a network that handles roughly 44 million HTTP requests per second across more than 250 cities in over 100 countries, responds to over 1.2 trillion DNS queries per day, and has 121 Tbps of capacity for serving traffic and absorbing denial-of-service attacks. Security products often get smarter as one customer's incident — a new malware strain or botnet signature — informs protections for every other customer. But Cloudflare's architecture means the flywheel spins between products rather than just between users of a single tool.
Two examples illustrate the point. Cloudflare operates 1.1.1.1, one of the world's largest recursive DNS resolvers, and participates in the Certificate Transparency ecosystem, which logs every TLS certificate issued by a trusted root authority. The resolver gives Cloudflare visibility into newly registered and newly seen domains, and the CT logs show when they become active. Those domains feed categories used by Gateway and machine learning models designed to flag suspicious or potentially malicious domains early in their lifecycle.
Email security and the cross-product feedback loop
Cloudflare's acquisition of Area 1 pushes this integration further on the email front. Signals generated from the 1.1.1.1 resolver will help identify malicious email, while Area 1's familiarity with email-based threats feeds back into Gateway and 1.1.1.1 for Families DNS resolution. In a traditional setup, this kind of data sharing would require your IT or security team to piece it together. Here, data flows automatically between the products defending different points of an organization's attack surface, with the same policies for request logging, blocking, and remote browser isolation handling any malicious links delivered via email.
The tool is designed to let you act on the network's intelligence rather than just observe it. When you respond to an incident, hunt for threats, or tune policies, you become part of that feedback loop — insights on your side can protect other Cloudflare customers across the network.
Where Security Center is headed
Cloudflare positions Investigate as the starting point for a broader expansion of Security Center. Planned features include a file scanning portal that covers JavaScript files observed by Page Shield and executables scanned by Gateway, with an upload capability for ad hoc scans. Indicators of Compromise such as IPs and domains will link to information about known threat actors, their techniques and tactics, and the Cloudflare products that can be used against them. CVE search tools will surface software vulnerability details alongside explainers in plain language. Future roadmaps aside, the primary goal of this release is putting the intelligence that powers Cloudflare's own threat defense directly into customers' hands.
