# Splunk .conf26 Highlights AI-Driven Efficiency in Security Operations > The live demonstration of the Agentic SOC at Splunk .conf26 highlighted how blending AI with human expertise can redefine cybersecurity operations, particularly in dynamic environments. This collaboration offered insights into achieving optimal network safety while navigating complex data contexts. **Source**: blogs.cisco.com | **Published**: 2026-10-08 | **Type**: article ## Key Facts - Splunk ES centralized 26,207 evidence pieces, enhancing analyst efficiency and decision-making speed. - 94% triage analysis coverage indicates strong agent performance, reducing human error in threat detection. - 1,503 AI events with 44% true positives reveal effective automation, lowering operational costs for SOCs. - Rapid data onboarding enabled quick adaptation, showcasing agility as a competitive advantage in security. - Human-led, evidence-based model balances automation with oversight, ensuring accountability in SOC operations. ## Summary At Splunk .conf26, the company demonstrated a live Agentic Security Operations Center (SOC) that integrated advanced AI capabilities with human oversight to enhance cybersecurity operations. This initiative, a collaboration with Cisco and Endace, showcased how modern SOCs can effectively transition from raw data to validated security decisions in dynamic environments. The event highlighted the critical balance between automated processes and human expertise, a model that could reshape industry standards for security operations. The SOC's primary objective was to protect the network and ensure a seamless experience for attendees while managing the complexities of a high-traffic conference environment. Given the unique context of .conf26, where typical corporate alerts could represent normal activity, the SOC had to contextualize events accurately. Splunk's Enterprise Security (ES) platform served as the backbone for this operation, centralizing data and facilitating a shared understanding among analysts. This approach allowed the team to evaluate security events against a backdrop of extensive telemetry, ensuring that not every anomaly triggered an alert. The integration of various data sources was pivotal. Cisco's suite of security tools contributed account, endpoint, and perimeter data, while Endace provided deeper network insights. This comprehensive telemetry allowed analysts to connect activities across the network and assess risks effectively. The SOC's design emphasized that while AI could handle repetitive tasks at scale, human analysts remained essential for final decision-making, ensuring accountability and informed action. A notable feature of the SOC was the AI Triage Agent, which prepared findings for analysts by gathering context and suggesting next steps. Throughout the event, the Triage Agent generated significant metrics, including 1,503 AI events and 26,207 pieces of evidence considered. This data not only illustrated the agent's operational capacity but also facilitated real-time discussions among analysts about its effectiveness and areas for improvement. The dashboard created during the event provided transparency into the agent's performance, fostering a collaborative environment for refining processes. The blended team structure within the SOC was equally important. Analysts at various tiers collaborated to monitor, investigate, and respond to findings. This model ensured that the AI Triage Agent operated within a well-defined context, enabling it to support analysts effectively while still allowing for human validation. The event underscored the importance of having a human-led, evidence-based approach to security operations, which can enhance both the speed and accuracy of threat detection and response. The insights gained from .conf26 signal a broader trend in the cybersecurity landscape. As organizations increasingly face sophisticated threats, the ability to integrate AI with human expertise will likely become a competitive differentiator. Companies looking to enhance their security posture may need to adopt similar models that leverage both technology and human judgment. The emphasis on data onboarding and agent visibility will be crucial for organizations aiming to streamline their security operations while maintaining oversight. Looking ahead, businesses should consider investing in integrated security frameworks that prioritize collaboration between AI and human analysts. This approach not only enhances operational efficiency but also builds resilience against evolving threats. As the market continues to evolve, organizations that can effectively harness the strengths of both AI and human insight will be better positioned to navigate the complexities of cybersecurity. ## Entities - **Companies**: Splunk, Cisco, Endace - **Products**: Splunk Enterprise Security, Cisco Duo, Cisco Secure Endpoint, Cisco Firewall Threat Defense, Splunk Exposure Analytics, Splunk Attack Analyzer - **Technologies**: AI Triage Agent, network detection, packet-level investigation - **Organizations**: Splunk Threat Research Team ## Key Concepts Agentic Security Operations Center (SOC), data normalization and correlation, human validation in security operations, AI-assisted triage, evidence-based decision making, telemetry integration, analyst roles in SOC, event-driven security operations ## Definitions - **Agentic SOC**: A modern Security Operations Center that integrates human analysts with AI tools to enhance decision-making and incident response. - **Triage Agent**: An AI tool designed to prepare findings and provide suggested actions for human analysts in a security operations context. - **Telemetry**: Data collected from various sources that provides insights into security events and network behavior. - **Evidence Layer**: A centralized system that aggregates and contextualizes data to support decision-making in security operations. - **Human Validation**: The process by which human analysts review and confirm the findings and recommendations generated by automated tools. ## Use Cases - Monitoring network activity during events - Validating security findings in real-time - Integrating multiple data sources for comprehensive analysis - Automating initial triage processes - Providing a dashboard for operational visibility - Educating customers on SOC operations ## Frequently Asked Questions **What is the purpose of the Triage Agent?** The Triage Agent is designed to assist analysts by preparing findings and suggesting actions based on the evidence it gathers. This allows human analysts to focus on validation and decision-making. **How does Splunk Enterprise Security support the SOC?** Splunk Enterprise Security serves as the primary platform for analysts, centralizing detections, risk context, and workflows. It enables a unified view of security data, facilitating faster and more informed decisions. **What role does human validation play in the SOC?** Human validation is crucial as it ensures that the findings generated by automated tools are accurate and actionable. Analysts review the Triage Agent's recommendations to confirm or adjust the suggested actions. **What types of telemetry were used during .conf26?** The SOC utilized various telemetry sources including Cisco Duo for account information, Cisco Secure Endpoint for endpoint activity, and network data from the convention center provider, among others. **What were some key metrics tracked by the Triage Agent dashboard?** The dashboard tracked several metrics including the number of AI events, SPL queries generated, evidence considered, and triage analysis coverage. These metrics provided insights into the agent's performance and operational effectiveness. ## Links - [Read on Welcome.AI](https://welcome.ai/content/splunk-conf26-highlights-ai-driven-efficiency-in-security-operations) - [Original source](https://blogs.cisco.com/security/conf26-agentic-soc-triage-agent) - [Cisco](https://welcome.ai/company/cisco): Featured company --- Source: Welcome.AI | https://welcome.ai/content/splunk-conf26-highlights-ai-driven-efficiency-in-security-operations