IndicatorFeed

Source: src/Cloudflare/Intel/IndicatorFeed.ts

A Cloudflare custom Indicator Feed (Cloudforce One threat intelligence).

Indicator feeds let approved accounts publish their own threat-intel indicators (domains, IPs, URLs) that consumer accounts can subscribe to via Gateway or download directly. Creating feeds requires the account to be approved as a feed provider (a Cloudforce One entitlement) — without it, creation fails with the typed IndicatorFeedsNotEntitled error.

Cloudflare’s API exposes no delete endpoint for indicator feeds. Destroying this resource orphans the feed on Cloudflare’s side (a warning is logged). To avoid leaking feeds across deployments, the provider adopts an existing feed with the same name instead of creating a duplicate.

Creating a Feed

Basic feed

const feed = yield* Cloudflare.IndicatorFeed("threat-feed", {
  description: "Indicators observed by our honeypots",
});

Public, downloadable feed

const feed = yield* Cloudflare.IndicatorFeed("public-feed", {
  name: "acme-public-indicators",
  description: "Acme Corp public threat indicators",
  isPublic: true,
  isDownloadable: true,
  isAttributable: true,
});

Publishing Indicators

const feed = yield* Cloudflare.IndicatorFeed("threat-feed", {
  description: "Indicators observed by our honeypots",
  snapshot: JSON.stringify({
    type: "bundle",
    id: "bundle--0a242344-3c0b-4fdb-9f59-3e8c4a4f6b3a",
    objects: [],
  }),
});

Sharing a Feed

yield* Cloudflare.IndicatorFeedPermission("partner-access", {
  feedId: feed.feedId,
  accountTag: "023e105f4ecef8ad9ca31a8372d0c353",
});