Security Center

TL;DR: Brand Protection now features an Automated Cease & Desist (C&D) workflow. When you discover an infringing domain hosted outside of Cloudflare, you can instantly generate, review, and download a custom-branded, pre-filled legal notice in seconds. Why this matters This update introduces a major shift from pure detection to actionable enforcement, eliminating the manual burden for your Trust…

Cloudforce One users can now turn Threat Events indicators into active defense. With this update, users can instantly generate a WAF rule that matches the dynamic list of IP addresses returned by any of their Saved Views. Why this matters Threat intelligence is most effective when it is immediately actionable. Previously, blocking threat actors required manually extracting indicators from threat…

TL;DR: We’ve launched Threat Actor Profiles directly inside the Threat Events dashboard. You can now immediately pivot from a generic alert or blocked event to a profile that unmasks the "Who, Why, and How" behind a threat event. Why this matters Security teams often suffer from a visibility gap. When an attack is blocked, it's difficult to know if it was a random automated bot or a sophisticated…

Security Insights scans now run more often. Cloudflare scans Free accounts every 7 days, Pro and Business accounts every 3 days, and Enterprise accounts daily. In addition, all accounts and zones now receive scans by default. You no longer need to enable scans before Cloudflare checks your account for misconfigurations, vulnerabilities, and other security risks. Granular on-demand scans are now a…

We’ve added a new Agent Readiness tab to URL Scanner reports accessible via the Cloudflare dashboard. This feature evaluates your site against emerging AI standards and provides six specialized scores to help you optimize for the next generation of AI agents and automated discovery. The Internet is shifting from a human-read web to a machine-read web. AI agents now browse, interact with, and even…

You can now export your Requests for Information (RFI) history to a CSV document and customize your dashboard view by choosing how many RFI records to load per page. Why this matters These quality-of-life updates focus on data portability and dashboard performance, allowing power users to manage high volumes of requests more efficiently: The new CSV export allows you to move RFI data into externa…

The Cloudforce One Threat Events API now supports TAXII ↗︎ as an output format, enabling standardized, automated sharing of cyber threat intelligence with your existing security stack. Why this matters You can now ingest Cloudforce One threat data directly into your SIEM, TIP or SOAR tools that prefer TAXII-formatted streams without needing custom translation scripts. By supporting the TAXII form…

We have introduced a unified investigation workspace within Brand Protection to help analysts manage complex brand portfolios. Instead of jumping between individual queries, you can now consolidate your workflow into a single, cohesive view. What's new You can now elect multiple saved queries from your dashboard to generate a consolidated "Combined Matches" view. This allows you to triage results…

You can now automate your threat monitoring by setting up custom alerts in your saved views. Instead of manually checking the dashboard for updates, you can subscribe to notifications that trigger whenever new data matches your specific filter sets, like new activity associated to a particular threat actor or spikes in activity within your industry. Stay ahead of emerging threats By linking your…

We are introducing Logo Match Preview, bringing the same pre-save visibility to visual assets that was previously only available for string-based queries. This update allows you to fine-tune your brand detection strategy before committing to a live monitor. What’s new: Upload your brand logo and immediately see a sample of potential matches from recently detected sites before finalizing the query…

We have introduced new triage controls to help you manage your Brand Protection results more efficiently. You can now clear out the noise by dismissing matches while maintaining full visibility into your historical decisions. What's new Dismiss matches: Users can now mark specific results as dismissed if they are determined to be benign or false positives, removing them from the primary triage vi…

TL;DR: You can now create and save custom configurations of the Threat Events dashboard, allowing you to instantly return to specific filtered views — such as industry-specific attacks or regional Sankey flows — without manual reconfiguration. Why this matters Threat intelligence is most effective when it is personalized. Previously, analysts had to manually re-apply complex filters (like combini…

We have introduced dynamic visualizations to the Threat Events dashboard to help you better understand the threat landscape and identify emerging patterns at a glance. What's new: Sankey Diagrams: Trace the flow of attacks from country of origin to target country to identify which regions are being hit hardest and where the threat infrastructure resides. Dataset Distribution over time: Instantly…

We have significantly upgraded our Logo Matching capabilities within Brand Protection. While previously limited to approximately 100% matches, users can now detect a wider range of brand assets through a redesigned matching model and UI. What's new Configurable match thresholds: Users can set a minimum match score (starting at 75%) when creating a logo query to capture subtle variations or high-q…

Identifying threat actors can be challenging, because naming conventions often vary across the security industry. To simplify your research, Cloudflare Threat Events now include an Also known as field, providing a list of common aliases and industry-standard names for the groups we track. This new field is available in both the Cloudflare dashboard and via the API. In the dashboard, you can view…

We have expanded the reporting capabilities of the Cloudflare URL Scanner. In addition to existing JSON and HAR exports, users can now generate and download a PDF report directly from the Cloudflare dashboard. This update streamlines how security analysts can share findings with stakeholders who may not have access to the Cloudflare dashboard or specialized tools to parse JSON and HAR files. Key…

We are excited to announce that Cloudflare Threat Events now supports the STIX2 (Structured Threat Information Expression) format. This was a highly requested feature designed to streamline how security teams consume and act upon our threat intelligence. By adopting this industry-standard format, you can now integrate Cloudflare's threat events data more effectively into your existing security ec…

The threat events platform now has threat insights available for some relevant parent events. Threat intelligence analyst users can access these insights for their threat hunting activity. Insights are also highlighted in the Cloudflare dashboard by a small lightning icon and the insights can refer to multiple, connected events, potentially part of the same attack or campaign and associated with…

The Brand Protection logo query dashboard now allows you to use the Report to Cloudflare button to submit an Abuse report directly from the Brand Protection logo queries dashboard. While you could previously report new domains that were impersonating your brand before, now you can do the same for websites found to be using your logo without your permission. The abuse reports will be prefilled and…

The Requests for Information (RFI) dashboard now shows users the number of tokens used by each submitted RFI to better understand usage of tokens and how they relate to each request submitted. What’s new: Users can now see the number of tokens used for a submitted request for information. Users can see the remaining tokens allocated to their account for the quarter. Users can only select the Rout…

Cloudflare's new Application Security report, currently in Closed Beta, is now available in the dashboard. Go to Security reports ↗ The reports are generated monthly and provide cyber security insights trends for all of the Enterprise zones in your Cloudflare account. The reports also include an industry benchmark, comparing your cyber security landscape to peers in your industry. Learn more abou…

Brand Protection detects domains that may be impersonating your brand — from common misspellings (cloudfalre.com) to malicious concatenations (cloudflare-okta.com). Saved search queries run continuously and alert you when suspicious domains appear. You can now create and save multiple queries in a single step, streamlining setup and management. Available now via the Brand Protection bulk query cr…

The Brand Protection API is now available, allowing users to create new queries and delete existing ones, fetch matches and more! What you can do: create new string or logo query delete string or logo queries download matches for both logo and string queries read matches for both logo and string queries Ready to start? Check out the Brand Protection API in our documentation.

Enterprise customers can now choose the geographic location from which a URL scan is performed — either via Security Center in the Cloudflare dashboard or via the URL Scanner API. This feature gives security teams greater insight into how a website behaves across different regions, helping uncover targeted, location-specific threats. What’s new: Location Picker: Select a location for the scan via…