Machine-extracted indicators need usable provenance without making every investigation slower.
Analyst trust requires evidence context while customer integrations require a stable, simple Threat Intelligence API.
Who you’d be doing this for
“I’m pasting source links into case notes because the event doesn’t tell me why it exists.”
Jakub Ivanov · Threat Intelligence Analyst
Reviews indicators for a security service customer before sending them into detection and response controls.
What is at stake
Analysts are copying source evidence into separate notes because Threat Events lack it at the point of use. You have to weigh a simple API against enough provenance for a defensible mitigation decision.
Why it isn’t already fixed
Every obvious fix costs something else. That’s the part you’d have to decide.
- API simplicity vs evidence depth
- automation speed vs analyst trust
- launch scope vs durable auditability
- customer adoption vs schema complexity
Why Cloudflare
Threat Events and the Threat Intelligence API are where Cloudflare turns network and research signals into customer mitigation decisions.
Written with these in mind
Not your kind of problem? 51 more at Cloudflare, or browse every organization.
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.