Admin within the Loop: Firewalls and the Agentic SOC
At Splunk .conf26 in Denver, our group operated the dwell Safety Operations Middle (SOC) defending greater than 5,145 attendees representing 70 international locations, together with all attending Splunkers. We monitored multi-gigabit site visitors whereas defending dwell seize the flag assault simulations and dynamic demo environments working all through the venue. The true innovation was not the sheer quantity of site visitors, however the structure of the SOC itself.
We constructed the occasion SOC round a multi-stage agentic pipeline:
- Reside telemetry feeds Splunk Enterprise Safety
- Autonomous triage brokers speed up Tier 1 evaluation
- Cisco Cloud Management enforces confidence gates
- Human analysts make decisive response calls
On this mannequin, the firewall acts because the stage one sign engine. As a result of your complete agentic workflow is capped by the standard of preliminary knowledge, maximizing inspection depth with out including venue latency was paramount.
The occasion Community Operations Middle (NOC) managed the venue community, offering our SOC firewalls with devoted SPAN feeds immediately from their core switches. By working Safe Firewall 10, our bodily and digital firewalls delivered wire-speed Snort 3 detection, Encrypted Visibility Engine telemetry, and protocol anomaly monitoring with zero impression on manufacturing site visitors. Behind the scenes, Cisco Cloud Management unified our on-premises and Cloud-Delivered Firewall Administration Middle (FMC) deployments right into a single console, preserving analysts targeted squarely on lively investigations.
Tapping the Wire
In fashionable enterprise networks the place encrypted site visitors is the usual default, conventional 5-tuple firewall guidelines and static port filters generate overwhelming noise whereas lacking actual adversary habits. To feed excessive context knowledge into Splunk Enterprise Safety (ES) and empower autonomous brokers, firewall telemetry should evolve from uncooked connection logs into excessive worth behavioral tales.
Inside Cisco Cloud Management, that story comes collectively in Unified Occasions. Slightly than forcing firewall directors to leap between disjointed dashboards and uncooked syslog streams, Unified Occasions unifies your complete spectrum of firewall telemetry right into a single cohesive view. It captures normal Connection occasions to trace software id and byte volumes, correlates them with Safety associated connection occasions from area filtering and TLS insurance policies, and layers on deep Intrusion occasions from Snort 3. When suspicious payloads cross the wire, community File occasions and sandbox Malware verdicts connect on to the move, whereas underlying Troubleshoot occasions present instant operational context if packets drop or engines pressure.
This unified lens transforms menace detection from atomic alerts into significant safety context. Snort 3 prioritizes high-impact classifications and teams associated occasions throughout a number of endpoints, immediately revealing lateral motion and lively scanning. For encrypted classes, the Encrypted Visibility Engine (EVE) inspects Consumer Hey handshakes, packet lengths, and timing dynamics immediately on the wire. This identifies malicious processes and command and management site visitors with excessive confidence, all with out the efficiency or privateness overhead of SSL decryption. In the meantime, monitoring outbound byte surges catches knowledge staging in actual time, cleartext protocol audits uncover uncovered credentials earlier than they are often abused, and DNS sinkholing delivers a zero false optimistic alert the second an contaminated machine tries to name house.
Superior Logging to Splunk & Tuning
The core operational suggestions loop begins with excessive constancy knowledge supply. As a substitute of overwhelming the SOC with unstructured syslog dumps, our firewalls stream structured telemetry immediately into Splunk Enterprise Safety utilizing Superior Logging in JSON format. This provides Splunk ES with standardized Frequent Info Mannequin fields on arrival. EVE course of tags, Snort 3 classifications, Talos menace scores, and DNS sinkhole indicators arrive totally packaged, giving Splunk AI Triage Brokers instant and undisputed floor reality.
This structured telemetry drives a elementary shift in each day operations by transferring safety analysts past remoted alerts and atomic findings into unified Investigations. Slightly than chasing tons of of disconnected notable occasions, Splunk ES combines wealthy firewall indicators with endpoint, id, and cloud telemetry to assemble a single incident narrative. Autonomous triage brokers can hint an attacker from their preliminary exploit try and encrypted command and management beaconing in minutes.
Whereas Splunk drives lively investigations within the SOC, directors keep firewall well being immediately inside Cloud Management. Inside Safety, AgenticOps applies AI intelligence to firewall administration by analyzing rule hit counts, pruning shadow guidelines, and optimizing coverage analysis order. This slashes the SIEM ingest tax by eliminating redundant log quantity earlier than it ever leaves the firewall, whereas preserving compute assets targeted on deep behavioral inspection.
The Horizon: Cisco Cloud Management & AI Canvas
Safety is now natively constructed into Cisco Cloud Management, the unified operations platform that brings Networking, Safety, Observability, and Cloud into one constant atmosphere. With out changing particular person product controllers, Cisco Cloud Management unifies stock, topology, actions, id, and workflows right into a single operational interface. This helps an AgenticOps mannequin the place ruled AI brokers assist operators correlate cross-domain telemetry, examine rising points, and take decisive motion throughout your complete IT property.
Central to this expertise is AI Canvas, a shared workspace the place human operators and AI brokers collaborate to resolve advanced incidents. Slightly than ranging from scratch, directors can immediate AI Canvas for situational greatest practices, resembling asking optimally construction, filter, and stream Cisco Safe Firewall logs into Splunk. AI Canvas unifies telemetry from Cisco platforms and organizational information right into a single, structured investigation. It preserves your complete chain of questions, proof, and selections so groups collaborate seamlessly with out shedding context.
This bridges the normal divide between Community Engineering and the SOC. When firewall directors design inspection with intent, leverage AgenticOps to optimize firewall well being, and stream structured telemetry into Splunk, they elevate your complete safety group.
Take a look at the opposite blogs by our Agentic SOC group at .conf26.
