Cisco and Splunk run an agentic SOC at .conf26 using Secure Firewall telemetry, Cloud Control and AI triage agents
Cisco described how its team ran the live Security Operations Center at Splunk .conf26 in Denver, protecting more than 5,145 attendees from 70 countries. The SOC used a multi-stage agentic pipeline: live telemetry feeds Splunk Enterprise Security, autonomous triage agents accelerate Tier 1 analysis, Cisco Cloud Control enforces confidence gates, and human analysts make the final response decisions. The article is vendor product and architecture content. It reports no specific incidents, vulnerabilities or threat actors, and it covers only the event's simulated CTF attacks and demo environments.
Detalhes técnicos
- Cisco Secure Firewall 10 (physical and virtual) took dedicated SPAN feeds from the venue core switches. It provided wire-speed Snort 3 detection, Encrypted Visibility Engine (EVE) telemetry and protocol anomaly tracking.
- EVE inspects Client Hello handshakes, packet lengths and timing to identify malicious processes and C2 traffic without SSL decryption.
- Unified Events in Cisco Cloud Control combines connection, security-related connection, intrusion, file, malware and troubleshoot events into a single view.
- Firewalls stream structured JSON telemetry to Splunk ES via Advanced Logging, mapped to Common Information Model fields. It includes EVE process tags, Snort 3 classifications, Talos threat scores and DNS sinkhole indicators for Splunk AI Triage Agents.
- Detection use cases mentioned: lateral movement and scanning grouping, outbound byte surges as a sign of data staging, cleartext credential exposure audits, and DNS sinkholing for infected hosts.
- AgenticOps analyzes rule hit counts, prunes shadow rules and optimizes policy order to reduce log volume. AI Canvas is a shared workspace for human operators and AI agents.
Remediação
No remediation applies. The article offers design guidance: stream structured firewall telemetry into the SIEM, tune rules to cut redundant logging, and keep a human in the loop for response decisions.
Linha do tempo
-
Cisco and Splunk run an agentic SOC at .conf26 using Secure Firewall telemetry, Cloud Control and AI triage agents
ler a análise desta fonte ocultar
Cisco described how its team ran the live Security Operations Center at Splunk .conf26 in Denver, protecting more than 5,145 attendees from 70 countries. The SOC used a multi-stage agentic pipeline: live telemetry feeds Splunk Enterprise Security, autonomous triage agents accelerate Tier 1 analysis, Cisco Cloud Control enforces confidence gates, and human analysts make the final response decisions. The article is vendor product and architecture content. It reports no specific incidents, vulnerabilities or threat actors, and it covers only the event's simulated CTF attacks and demo environments.
Technical Details
- Cisco Secure Firewall 10 (physical and virtual) took dedicated SPAN feeds from the venue core switches. It provided wire-speed Snort 3 detection, Encrypted Visibility Engine (EVE) telemetry and protocol anomaly tracking.
- EVE inspects Client Hello handshakes, packet lengths and timing to identify malicious processes and C2 traffic without SSL decryption.
- Unified Events in Cisco Cloud Control combines connection, security-related connection, intrusion, file, malware and troubleshoot events into a single view.
- Firewalls stream structured JSON telemetry to Splunk ES via Advanced Logging, mapped to Common Information Model fields. It includes EVE process tags, Snort 3 classifications, Talos threat scores and DNS sinkhole indicators for Splunk AI Triage Agents.
- Detection use cases mentioned: lateral movement and scanning grouping, outbound byte surges as a sign of data staging, cleartext credential exposure audits, and DNS sinkholing for infected hosts.
- AgenticOps analyzes rule hit counts, prunes shadow rules and optimizes policy order to reduce log volume. AI Canvas is a shared workspace for human operators and AI agents.
Remediation
No remediation applies. The article offers design guidance: stream structured firewall telemetry into the SIEM, tune rules to cut redundant logging, and keep a human in the loop for response decisions.