How Cisco used Splunk as the SOC data platform at .conf26 to unify security telemetry and track the Splunk AI Triage Agent with human-validated workflows.
Splunk .conf26: Tracking the Triage Agent in the Agentic SOC
About this summary. This is a short, independently written summary of an article first published by Cisco Security. Cyber Security News did not report or verify the underlying story. Read the original: https://blogs.cisco.com/security/conf26-agentic-soc-triage-agent/
Source attribution: headline and facts are from Cisco Security (blogs.cisco.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Making sure the checks get printed
Welcome to this week’s edition of the Threat Source newsletter. My name is Pierre Cadieux, and I’ll be helping contribute to these newsletters. A little about me: I’ve…
Admin in the Loop: Firewalls and the Agentic SOC
Discover how Cisco Secure Firewall and Cloud Control stream structured Snort 3 and EVE telemetry into Splunk ES to power the .conf26 Agentic SOC pipeline.
The Zero-Day Blind Spot: Why Your Agentic SOC needs Retrospective Packet Replay
Learn how the .conf26 Agentic SOC paired Endace full PCAP with Cisco Secure Firewall and Talos rules to retrospectively replay wire data against zero-days.
One Cisco in Action: Inside the Agentic SOC at .conf26
Read how Cisco Cloud Control and Splunk Enterprise Security powered the live Agentic SOC at .conf26 to deliver unified TDIR across live event traffic.
Cisco Warns of Exploited Secure Email Gateway Vulnerability
Unauthenticated, remote attackers could write arbitrary files to the operating system and execute commands with root privileges.
Cisco security advisory (AV26-1042)
Serial number: AV26-1042 Date: October 14, 2026 As of October 14, 2026, Cisco is affected by a vulnerability in the following products: Cisco AsyncOS Software for Cisco…