Splunk .conf26 live Agentic SOC shows ES AI Triage Agent handling 1,503 events under human validation
At Splunk .conf26, Cisco, Splunk and Endace ran a live Agentic Security Operations Center (SOC) built around the Splunk Enterprise Security (ES) AI Triage Agent. The agent prepared findings, with a suggested disposition, rationale and next steps, and human analysts validated the evidence and made the decisions. No threat activity or incident is reported. This is a product and operations showcase with no direct threat to defenders. The team built an operations dashboard in an afternoon that reported 1,503 AI agentic events, 7,605 SPL queries, 26,207 pieces of evidence considered, 14,279 hypotheses considered, 11,250 threat intelligence lookups and 94% triage analysis coverage. The authors state these are event-environment observations, not product benchmarks.
Technical Details
- Data sources: Cisco Duo (identity and login), Cisco Secure Endpoint, Cisco Firewall Threat Defense, convention-center NOC DHCP and DNS data, Endace Zeek, Suricata IDS and PCAP, Splunk Exposure Analytics and Splunk Attack Analyzer.
- Staffing: Tier 1, Tier 2 and Tier 3 analysts, detection engineers and the Splunk Threat Research Team.
- Operating model: the agent investigates findings in the queue, and analysts close, escalate or investigate further, preserving the path from telemetry to finding to agent analysis to analyst decision.
Remediation
No remediation applies. The authors recommend a human-led, evidence-based model, visibility into agent activity, confidence and coverage, and prioritizing data onboarding into the SOC platform.
Linha do tempo
-
Splunk .conf26 live Agentic SOC shows ES AI Triage Agent handling 1,503 events under human validation
ler a análise desta fonte ocultar
At Splunk .conf26, Cisco, Splunk and Endace ran a live Agentic Security Operations Center (SOC) built around the Splunk Enterprise Security (ES) AI Triage Agent. The agent prepared findings, with a suggested disposition, rationale and next steps, and human analysts validated the evidence and made the decisions. No threat activity or incident is reported. This is a product and operations showcase with no direct threat to defenders. The team built an operations dashboard in an afternoon that reported 1,503 AI agentic events, 7,605 SPL queries, 26,207 pieces of evidence considered, 14,279 hypotheses considered, 11,250 threat intelligence lookups and 94% triage analysis coverage. The authors state these are event-environment observations, not product benchmarks.
Technical Details
- Data sources: Cisco Duo (identity and login), Cisco Secure Endpoint, Cisco Firewall Threat Defense, convention-center NOC DHCP and DNS data, Endace Zeek, Suricata IDS and PCAP, Splunk Exposure Analytics and Splunk Attack Analyzer.
- Staffing: Tier 1, Tier 2 and Tier 3 analysts, detection engineers and the Splunk Threat Research Team.
- Operating model: the agent investigates findings in the queue, and analysts close, escalate or investigate further, preserving the path from telemetry to finding to agent analysis to analyst decision.
Remediation
No remediation applies. The authors recommend a human-led, evidence-based model, visibility into agent activity, confidence and coverage, and prioritizing data onboarding into the SOC platform.