Government threat intel lands in Cloudflare Gateway
Cloudflare has partnered with the U.S. Department of the Treasury and the Department of Energy's Pacific Northwest National Laboratory (PNNL) to bring government-sourced threat intelligence into its platform via Custom Indicator Feeds. The move aligns with the White House's National Cybersecurity Strategy, which pushes for public-private collaboration to harden critical infrastructure. The Treasury serves as the lead agency for the financial sector under that strategy.
The first practical outcome: approved financial institutions can now create DNS filtering policies in Cloudflare Gateway that draw directly on threat data from the Treasury and federal sources. That data, previously confined to government use, includes indicators of compromise (IoCs) such as IP addresses, URLs, domain names, and file hashes, each enriched with context on associated malware, attack patterns, and severity.
Closing the intel-to-action gap
Security teams routinely share threat intelligence over out-of-band channels like email and Slack. The bottleneck has never been collection—it's integration. Manually folding those IoCs into defensive systems is slow and error-prone, and smaller teams often lack the resources to do it at all. The Treasury-PNNL feed is designed to remove that manual step, letting organizations automatically enforce blocks based on vetted federal intelligence.
Feed content is not assembled in isolation. IoCs are initially flagged by intrusion detection system (IDS) networks that monitor environments managed by entities like PNNL for the Treasury. Each indicator then goes through analyst review at PNNL and partner organizations to confirm it is genuinely malicious before being published. That validation layer is meant to keep false positives out of subscribers' security stacks.
Once verified, indicators are added to a dedicated feed and served to authorized users via Cloudflare's secure API. Subscribers can select the feed when building DNS filtering policies, and Gateway then blocks access to the malicious sites, phishing domains, and other threats identified by federal monitoring.
Two roles, one feed
Custom Indicator Feeds split participants into two groups with distinct responsibilities:
- Feed providers (e.g., Treasury and PNNL): Cloudflare exposes an API that lets providers publish and periodically update their indicator feeds. The API gives providers an automated pipeline for pushing newly confirmed threats into the platform, along with strict access controls to authorize which Gateway accounts may consume a given feed.
- Gateway customers (e.g., financial institutions): Once authorized for a feed, organizations build DNS filtering policies using its data. The mechanics mirror Cloudflare's own threat intelligence, with one difference: the feed provider must explicitly grant an account access.
Roadmap and eligibility
This initial release focuses on DNS filtering via Gateway, but Cloudflare has broader plans for Custom Indicator Feeds:
- Expanding feed availability to additional products, including WAF, Magic Firewall, and HTTP Gateway Policies.
- Allowing authorized accounts to download specific feed lists for greater flexibility.
- Enabling multiple organizations to upload individual indicators to shared feeds, building a collaborative threat-intel ecosystem.
The offering is free for any financial institution recognized by the Department of Treasury that already uses Cloudflare Gateway. Eligible organizations can request access through Cloudflare's signup page, and the developer documentation provides details on consuming or building custom indicator feeds.
