Cisco, Splunk and SentinelOne detail integrated runtime protection and automated response for cloud workloads
Cisco published a vendor blog describing how SentinelOne Cloud Workload Protection (CWP) integrates with Cisco ISE, Cisco Duo and Splunk (Enterprise Security and SOAR). The aim is to turn a single runtime detection on containers, Kubernetes, VMs and serverless workloads into coordinated identity, network and SOC response. The article is product and partnership marketing and reports no incident, vulnerability or threat actor activity. It cites survey statistics from Splunk's State of Security 2025, Cisco's 2025 Cybersecurity Readiness Index and IBM's 2025 Cost of a Data Breach Report to support the pitch.
Detalhes técnicos
- Cisco ISE: a SentinelOne detection can trigger dynamic network quarantine and microsegmentation changes, isolating a compromised workload or endpoint without a manual handoff.
- Cisco Duo: Duo Desktop verifies that the SentinelOne agent is installed and running before granting access to a Duo-protected application. Devices without an active agent are blocked and guided through remediation.
- Splunk: SentinelOne telemetry and alerts stream into Splunk Enterprise Security and Splunk SOAR for correlation, cross-domain investigation and automated triage playbooks.
- SentinelOne CWP: behavior-based runtime detection aimed at zero-days and active exploits, plus blocking of unauthorized binaries and containment of lateral movement.
Remediação
No remediation applies, as the article describes no vulnerability. Defenders evaluating the integration are pointed to the Cisco ISE, Duo, Secure Firewall and Splunk integration guides and the SentinelOne App for Splunk.
Linha do tempo
-
Cisco, Splunk and SentinelOne detail integrated runtime protection and automated response for cloud workloads
ler a análise desta fonte ocultar
Cisco published a vendor blog describing how SentinelOne Cloud Workload Protection (CWP) integrates with Cisco ISE, Cisco Duo and Splunk (Enterprise Security and SOAR). The aim is to turn a single runtime detection on containers, Kubernetes, VMs and serverless workloads into coordinated identity, network and SOC response. The article is product and partnership marketing and reports no incident, vulnerability or threat actor activity. It cites survey statistics from Splunk's State of Security 2025, Cisco's 2025 Cybersecurity Readiness Index and IBM's 2025 Cost of a Data Breach Report to support the pitch.
Technical Details
- Cisco ISE: a SentinelOne detection can trigger dynamic network quarantine and microsegmentation changes, isolating a compromised workload or endpoint without a manual handoff.
- Cisco Duo: Duo Desktop verifies that the SentinelOne agent is installed and running before granting access to a Duo-protected application. Devices without an active agent are blocked and guided through remediation.
- Splunk: SentinelOne telemetry and alerts stream into Splunk Enterprise Security and Splunk SOAR for correlation, cross-domain investigation and automated triage playbooks.
- SentinelOne CWP: behavior-based runtime detection aimed at zero-days and active exploits, plus blocking of unauthorized binaries and containment of lateral movement.
Remediation
No remediation applies, as the article describes no vulnerability. Defenders evaluating the integration are pointed to the Cisco ISE, Duo, Secure Firewall and Splunk integration guides and the SentinelOne App for Splunk.