Cisco and Splunk Agentic SOC at .conf26 detects fake-Corepack npm infostealer C2 traffic from a compromised attendee laptop
Cisco and Splunk ran a live Agentic SOC at Splunk .conf26, combining Cisco Cloud Control, Splunk Enterprise Security (ES), Cisco Talos intelligence and Endace continuous packet capture, with Jamf engineers also on the team. The article is largely a product and event retrospective. Its one security incident was a fake-Corepack npm credenti…