/
← Voltar ao feed
low

Cisco SOC at Splunk .conf26 replays Endace packet captures against new Talos rules for JFrog Artifactory CVE-2026-82329; no exploitation found

1 fonte(s) · 1 atualização(ões) · publicado 08/10/2026 12:00 · coletado há 4 dias

Cisco's Agentic SOC team at Splunk .conf26 showed how retrospective packet replay can check for past zero-day exploitation. They used full line-rate packet capture from Endace, intrusion detection on Cisco Secure Firewall Threat Defense (FTD), and rule updates from Cisco Talos. The scenario was Talos releasing new rules for CVE-2026-82329, a critical (CVSS 9.8) flaw in JFrog Artifactory. Replaying earlier conference-network traffic against those rules produced no alerts, so no compromise was detected. The authors argue that NetFlow, Syslog and firewall logs lack payload content, and that conditional/selective PCAP never triggers for an unknown zero-day, so only continuous 100% capture lets a SOC validate a breach after the fact.

Detalhes técnicos

  • Cisco Secure Firewall Encrypted Visibility Engine (EVE) detected JFrog connections on the conference network from before the new rules existed. All of them went to the same destination IP, which was used to pull matching PCAPs from Endace.
  • The Endace search covered 4 days and 22TB of packet data and matched 139MB across 64 IP conversations.
  • The Endace InvestigationManager replayed the traffic through a dedicated replay interface (eth1) over an ERSPAN tunnel (Session ID 100). The FTD received it on a dedicated monitoring interface, which separated replayed traffic from live traffic.
  • Endace Replay is exposed through a RESTful API and through MCP for agentic use.
  • The new intrusion rules did not fire on the replayed traffic.
  • The article reports no exploitation of CVE-2026-82329 and gives no IOCs.

Remediação

  • Keep full-fidelity, line-rate packet capture so that history exists before a threat is identified.
  • Replay historical traffic against newly released IPS rules after each zero-day disclosure.
  • Maintain strong asset inventory so potentially affected hosts are known, and use firewall logs to find unexpected ones.
  • Add endpoint-level validation and enable TLS decryption to get full value from detections.

Linha do tempo

  1. blogs.cisco.com ↗ · pub. 08/10/2026 12:00 · coletado 19/10 18:08 primeiro registro

    Cisco SOC at Splunk .conf26 replays Endace packet captures against new Talos rules for JFrog Artifactory CVE-2026-82329; no exploitation found

    ler a análise desta fonte

    Cisco's Agentic SOC team at Splunk .conf26 showed how retrospective packet replay can check for past zero-day exploitation. They used full line-rate packet capture from Endace, intrusion detection on Cisco Secure Firewall Threat Defense (FTD), and rule updates from Cisco Talos. The scenario was Talos releasing new rules for CVE-2026-82329, a critical (CVSS 9.8) flaw in JFrog Artifactory. Replaying earlier conference-network traffic against those rules produced no alerts, so no compromise was detected. The authors argue that NetFlow, Syslog and firewall logs lack payload content, and that conditional/selective PCAP never triggers for an unknown zero-day, so only continuous 100% capture lets a SOC validate a breach after the fact.

    Technical Details

    • Cisco Secure Firewall Encrypted Visibility Engine (EVE) detected JFrog connections on the conference network from before the new rules existed. All of them went to the same destination IP, which was used to pull matching PCAPs from Endace.
    • The Endace search covered 4 days and 22TB of packet data and matched 139MB across 64 IP conversations.
    • The Endace InvestigationManager replayed the traffic through a dedicated replay interface (eth1) over an ERSPAN tunnel (Session ID 100). The FTD received it on a dedicated monitoring interface, which separated replayed traffic from live traffic.
    • Endace Replay is exposed through a RESTful API and through MCP for agentic use.
    • The new intrusion rules did not fire on the replayed traffic.
    • The article reports no exploitation of CVE-2026-82329 and gives no IOCs.

    Remediation

    • Keep full-fidelity, line-rate packet capture so that history exists before a threat is identified.
    • Replay historical traffic against newly released IPS rules after each zero-day disclosure.
    • Maintain strong asset inventory so potentially affected hosts are known, and use firewall logs to find unexpected ones.
    • Add endpoint-level validation and enable TLS decryption to get full value from detections.