4 casos · pág. 1/1
At Splunk .conf26, Cisco, Splunk and Endace ran a live Agentic Security Operations Center (SOC) built around the Splunk Enterprise Security (ES) AI Triage Agent. The agent prepared findings, with a suggested disposition, rationale and next steps, and human analysts validated the evidence and made the decisions. No threat activity or incid…
During the Splunk .conf conference, Cisco's Encrypted Visibility Engine (EVE) in Firewall Threat Defense (FTD) produced a previously unseen detection of Flawed AMMYY, a RAT built from leaked AMMYY source code, alongside the usual detections of Upatre, Xpiro and Quasar. Detections arrived in HTTP/HTTPS pairs with identical timestamps from …
Cisco and Splunk ran a live Agentic SOC at Splunk .conf26, combining Cisco Cloud Control, Splunk Enterprise Security (ES), Cisco Talos intelligence and Endace continuous packet capture, with Jamf engineers also on the team. The article is largely a product and event retrospective. Its one security incident was a fake-Corepack npm credenti…
Cisco's Agentic SOC team at Splunk .conf26 showed how retrospective packet replay can check for past zero-day exploitation. They used full line-rate packet capture from Endace, intrusion detection on Cisco Secure Firewall Threat Defense (FTD), and rule updates from Cisco Talos. The scenario was Talos releasing new rules for CVE-2026-82329…
