From the Cisco edition of October 29, 2026
Cisco and Splunk run a live agentic SOC at Splunk .conf26, with AI triage agents and human analysts making containment decisions
Cisco and Splunk (with Endace and Jamf) · Security operations / AI-assisted threat detection and response · United States (event network)
- Publisher
- Cisco Blogs
- Original publication
- Cisco Blogs, Oct. 8, 2026
- Source retrieved
- 2026-10-30
What happened
Cisco describes a live security operations center protecting attendee, exhibitor and venue network segments at Splunk .conf26, built on Cisco Cloud Control, Splunk Enterprise Security, Cisco security telemetry, Talos intelligence and Endace packet capture. AI agents (Splunk Triage Agent, Cisco AI Assistant) extracted entity context, correlated indicators, summarized events and drafted response playbooks, while human analysts made containment decisions. In one incident, a Tier 1 analyst using the triage agent flagged a connection to a known command-and-control domain; Tier 3 mapped the malware across 15 venue endpoints, verified it with packet capture, and staff located, quarantined and remediated an attendee laptop that arrived compromised. Cisco notes event traffic included training labs and exploit demos that would be adversarial on a corporate or government network.
Why it matters
The human-in-the-loop model (agents triage, people decide containment) matches how public-sector SOCs with small staffs are likely to adopt AI. Event networks differ from agency networks in device mix and risk tolerance.
Evidence and measured results
Opened the Cisco blog and read it in full. No time-to-detect, alert-volume or false-positive metrics are reported; companion analyst blog posts were not opened.
Limitations and uncertainty
Vendor showcase at its own event; temporary environment; no measured outcomes; one illustrative incident.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-30; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Public-sector SOCs have too few analysts for their alert volume.
- Stakeholders
- SOC manager
- CISO
- Network operations lead
- Privacy officer
- Discovery questions
- How many alerts go unreviewed each week?
- Which telemetry sources feed the SIEM today?
- Is full packet capture legally and policy-permitted?
- Value hypothesis
- AI triage with human containment approval may let a small team handle more alerts with traceable evidence.
- Potential engagement
- AI triage pilot on one historical alert category.
- Unsupported claims
- Faster detection metrics
- Fewer breaches
- That event-network results transfer to agency networks
Pre-sales engineering
Role takeaway
- Fit
- Fits SOCs already on Splunk ES with Cisco firewalls or DNS security.
- Architecture and integration
- Cloud Control as control plane, Splunk ES workbench, AI triage agents, Talos enrichment, optional packet capture for verification.
- Prerequisites
- Splunk ES deployment
- Firewall and DNS telemetry
- Analyst workflow documentation
- Constraints
- No metrics published
- Temporary event environment
- Several products and licences
- Security
- Packet capture and device location data need policy and retention limits.
- Proof of value
- Compare enrichment time on historical alerts
- Check agent findings against raw data
- Count false escalations
Delivery
Role takeaway
- Work
- Redesign SOC triage with agent steps and human approvals.
- Dependencies
- SIEM content
- Telemetry onboarding
- Policy on capture
- Ownership
- SOC manager
- Skills and adoption
- Tier 1 analysts learn to verify AI triage; Tier 3 reviews agent playbooks.
- Governance checkpoints
- Containment requires human approval
- Weekly accuracy sampling
- Privacy review for capture
- Acceptance criteria
- Approval points documented
- Triage time measured before and after
- Weekly review completed
- Risks
- Over-trust in summaries
- Privacy exposure
- Licence sprawl
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Value depends on joining firewall, DNS, switching and endpoint telemetry with SIEM and packet capture under one control plane; packet capture provided verification for AI findings.
Governance
Who approves, reviews and stays accountable for outcomes?
Containment decisions stayed with humans; Cisco frames agents as reducing analyst burden, not replacing analysts.
Security and privacy
What data, permissions and controls need testing?
Full packet capture and device location were used to find a user; public-sector use would need privacy policy and legal basis for such capture.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Tier 1 analysts used AI triage; relevant to junior SOC staff and student SOC programs.
Procurement
What should contracts, pricing and exit terms secure?
Architecture spans several products and a third-party capture vendor, implying multiple licences.
Operating model
Which teams own the service once it runs?
Tiered workflow: AI triage at Tier 1, escalation to Tier 3, network team for physical remediation.
Publication history
- 2026-10-29Cisco · Issue 0111 resources
Stable resource ID: cisco-splunk-agentic-soc-conf26-live-event-human-approved-containment-20261008