{"resourceId":"cisco-splunk-agentic-soc-conf26-live-event-human-approved-containment-20261008","versions":[{"version":"external-1923c6450cd6c9899c9e30fd9f0d17cbd677eaec9e3a04385579a49bf06cab20","resource":{"id":"cisco-splunk-agentic-soc-conf26-live-event-human-approved-containment-20261008","title":"Cisco and Splunk run a live agentic SOC at Splunk .conf26, with AI triage agents and human analysts making containment decisions","organization":"Cisco and Splunk (with Endace and Jamf)","sector":"Security operations / AI-assisted threat detection and response","geography":"United States (event network)","publishedAt":"Cisco Blogs, Oct. 8, 2026","publicationDate":"2026-10-08","eventDate":null,"sourceName":"Cisco Blogs","sourceLabel":"One Cisco in Action: Inside the Agentic SOC at .conf26","sourceUrl":"https://blogs.cisco.com/security/conf26-agentic-soc","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["data-security","operating-model","developers-agents"],"finding":"Cisco describes a live security operations center protecting attendee, exhibitor and venue network segments at Splunk .conf26, built on Cisco Cloud Control, Splunk Enterprise Security, Cisco security telemetry, Talos intelligence and Endace packet capture. AI agents (Splunk Triage Agent, Cisco AI Assistant) extracted entity context, correlated indicators, summarized events and drafted response playbooks, while human analysts made containment decisions. In one incident, a Tier 1 analyst using the triage agent flagged a connection to a known command-and-control domain; Tier 3 mapped the malware across 15 venue endpoints, verified it with packet capture, and staff located, quarantined and remediated an attendee laptop that arrived compromised. Cisco notes event traffic included training labs and exploit demos that would be adversarial on a corporate or government network.","sledRelevance":"The human-in-the-loop model (agents triage, people decide containment) matches how public-sector SOCs with small staffs are likely to adopt AI. Event networks differ from agency networks in device mix and risk tolerance.","evidence":"Opened the Cisco blog and read it in full. No time-to-detect, alert-volume or false-positive metrics are reported; companion analyst blog posts were not opened.","architectureImplications":"Value depends on joining firewall, DNS, switching and endpoint telemetry with SIEM and packet capture under one control plane; packet capture provided verification for AI findings.","governanceImplications":"Containment decisions stayed with humans; Cisco frames agents as reducing analyst burden, not replacing analysts.","securityPrivacyImplications":"Full packet capture and device location were used to find a user; public-sector use would need privacy policy and legal basis for such capture.","caveats":"Vendor showcase at its own event; temporary environment; no measured outcomes; one illustrative incident.","streamIds":["cisco"],"roles":{"sales":"Sales framing: the event SOC is a showcase, but it illustrates a defensible SLED pitch: AI agents do triage and evidence gathering while analysts keep containment authority. The customer problem is too few analysts for too many alerts. Discovery should ask about analyst headcount, alert backlog and existing telemetry sources. A bounded engagement could pilot AI triage on one alert category. Do not claim faster detection or fewer breaches; the post gives no metrics.","engineering":"Engineering framing: the stack joins Cloud Control, Splunk ES, firewall and DNS telemetry, Talos intelligence and packet capture, with AI agents enriching and correlating alerts. Pre-sales should map which of these sources an agency already has and whether full packet capture is permitted. A proof of value would run AI triage on historical alerts of one category, comparing enrichment time and accuracy with analyst work, and confirm every agent finding can be verified against raw data.","delivery":"Delivery framing: delivery is SOC workflow redesign: define which steps agents perform, where analysts approve, and how findings are verified. The operational owner is the SOC manager. Proposed acceptance criteria: documented approval points for containment, triage time measured before and after, and a sample of agent findings reviewed weekly for accuracy. Risks include over-trusting agent summaries and privacy problems from packet capture."},"roleDetails":{"sales":{"customerProblem":"Public-sector SOCs have too few analysts for their alert volume.","stakeholders":["SOC manager","CISO","Network operations lead","Privacy officer"],"discoveryQuestions":["How many alerts go unreviewed each week?","Which telemetry sources feed the SIEM today?","Is full packet capture legally and policy-permitted?"],"valueHypothesis":"AI triage with human containment approval may let a small team handle more alerts with traceable evidence.","potentialEngagement":"AI triage pilot on one historical alert category.","unsupportedClaims":["Faster detection metrics","Fewer breaches","That event-network results transfer to agency networks"]},"engineering":{"fit":"Fits SOCs already on Splunk ES with Cisco firewalls or DNS security.","architectureIntegration":"Cloud Control as control plane, Splunk ES workbench, AI triage agents, Talos enrichment, optional packet capture for verification.","prerequisites":["Splunk ES deployment","Firewall and DNS telemetry","Analyst workflow documentation"],"constraints":["No metrics published","Temporary event environment","Several products and licences"],"security":"Packet capture and device location data need policy and retention limits.","proofOfValue":["Compare enrichment time on historical alerts","Check agent findings against raw data","Count false escalations"]},"delivery":{"work":"Redesign SOC triage with agent steps and human approvals.","dependencies":["SIEM content","Telemetry onboarding","Policy on capture"],"ownership":"SOC manager","skillsAdoption":"Tier 1 analysts learn to verify AI triage; Tier 3 reviews agent playbooks.","governanceCheckpoints":["Containment requires human approval","Weekly accuracy sampling","Privacy review for capture"],"acceptanceCriteria":["Approval points documented","Triage time measured before and after","Weekly review completed"],"risks":["Over-trust in summaries","Privacy exposure","Licence sprawl"]}},"retrievedAt":"2026-10-30T03:11:39Z","enrichedAt":"2026-10-30T03:18:21Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Tier 1 analysts used AI triage; relevant to junior SOC staff and student SOC programs.","procurementImplications":"Architecture spans several products and a third-party capture vendor, implying multiple licences.","operatingModelImplications":"Tiered workflow: AI triage at Tier 1, escalation to Tier 3, network team for physical remediation.","sourceVerification":{"openedUrl":"https://blogs.cisco.com/security/conf26-agentic-soc","referenceExcerpt":"The Agentic SOC is not about replacing human defenders with autonomous black boxes.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}