Unleashing improved context for threat actor activity with our Cloudforce One threat events platform

This post introduces the Cloudforce One threat events platform, which provides contextual data about threats monitored and mitigated on the Cloudflare network. It leverages Cloudflare's traffic insights to offer a comprehensive, real-time view of threat activity. The platform is built using Cloudflare Workers and SQLite-backed Durable Objects for storage, allowing for dynamic table creation and scalable datasets. Events include those related to denial of service attacks and advanced threat operations tracked by the Cloudforce One Intelligence team, mapped to MITRE ATT&CK and cyber kill chain stages. The platform aims to empower customers to investigate and address threats targeting their organization by providing key information and actionable indicators of compromise.