What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Cloudflare’s Cloudforce One Threat Events is a threat-intelligence platform that turns attacks observed across Cloudflare’s network into contextual events customers can investigate in the dashboard or retrieve through an API. It goes beyond a list of suspicious IP addresses: events can include indicators of compromise (IoCs), summaries, associated threat actors, and mappings to MITRE ATT&CK and kill-chain stages.
What Cloudforce One Threat Events provides
Cloudflare announced the platform on March 18, 2025. It curates observed activity into events that pair technical indicators with context about the activity and, where available, the actors and techniques involved. That helps security teams investigate what happened and decide what to do with an indicator, rather than treating every IP or domain as an isolated item. Cloudflare’s launch announcement describes the service and its event data.
As an Amazon Associate I earn from qualifying purchases.
Cloudflare reports that its network processes 71 million HTTP requests per second and 44 million DNS queries per second. The launch announcement also says Cloudflare blocked an average of 227 billion cyber threats per day during Q4 2024. These are Cloudflare-reported network figures, not an independent measurement of the platform’s event coverage or detection accuracy. Cloudflare’s announcement
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What activity and context are covered
Initial event coverage
At launch, the event stream emphasized denial-of-service activity and advanced threat operations tracked by Cloudforce One analysts. Cloudflare said it planned to expand coverage later with datasets from its web application firewall (WAF), Zero Trust Gateway, and Email Security products. The launch material does not establish that every type of attack or every dataset is represented in every customer’s view. Cloudflare’s Threat Events overview
#1 Best Overall
Questions the data can help investigate
Cloudflare describes filtering events to examine which actors target a particular industry or country, which indicators may help block attacks, and what an adversary did across the kill chain. The event records can include IoCs, summaries, actor associations, and mappings to MITRE ATT&CK techniques and kill-chain stages. This context is the main distinction from a bare IP-reputation feed; it gives analysts more to assess before turning an indicator into a rule or response. Cloudflare’s Threat Events overview
How customers investigate and automate
Dashboard investigation
Cloudforce One customers can access Threat Events in the Security Center in the Cloudflare Dashboard. The interface includes an Attacker Timelapse view for exploring activity over time and a filterable events table for inspecting records. Filters let teams narrow events by questions such as geography, industry, actor, or indicators, depending on the available event data. Cloudflare’s Threat Events overview
API integration
Cloudflare also provides a Threat Events API, allowing customers to bring the intelligence into their own security workflows instead of relying solely on the dashboard. That can support investigation and automation alongside existing tools; the specific integration steps and compatibility with an individual SIEM or security product are not established in the launch materials. Access is for Cloudforce One customers. Cloudflare’s Threat Events overview
Alerts from saved views
On April 8, 2026, Cloudflare added immediate alerts and daily digests associated with saved views in the Notifications Center. Teams can use a saved filter to receive notice of matching activity without repeatedly checking the same dashboard view. Cloudflare’s April 8, 2026 changelog entry
Rank #3
What Cloudflare says powers the platform
Cloudflare says Threat Events uses Workers and SQLite-backed Durable Objects to store customizable datasets and scale across its network. The service’s underlying value proposition is to curate network-observed activity into events that are useful for analyst investigation and operational response, not simply to expose raw traffic volume. Cloudflare’s Threat Events overview
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to interpret Cloudflare’s performance claims
Cloudflare’s launch blog reports that a Fortune 20 threat-intelligence team tested the platform against 110 other sources, ranked Cloudflare first, and described it as “very much a unicorn.” This is a vendor-reported evaluation: the public account does not name the evaluator or provide its methodology or independent corroboration. It is therefore a positive customer anecdote, not enough on its own to establish comparative performance for other organizations. Cloudflare’s Threat Events overview
Rank #4
The service’s stated scale and contextual event design may be relevant when evaluating a threat-intelligence source, but they do not by themselves prove that an alert is current, actionable, or appropriate for a particular environment. Security teams should assess how event freshness, coverage, context, API access, filtering, alerting, and ATT&CK mapping fit their own workflows. Cloudflare’s public launch materials do not provide a neutral benchmark across those dimensions.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
