# Admin in the Loop: Firewalls and the Agentic SOC

DevFeed: [Admin in the Loop: Firewalls and the Agentic SOC](<https://devfeed.tech/articles/admin-in-the-loop-firewalls-and-the-agentic-soc-77373.md>)

Original publisher: [Read original article](<https://blogs.cisco.com/security/conf26-agentic-soc-firewalls/>)

Author: Andrew Merica

Published: 2026-10-08T15:00:58Z

Content type: article

Language: en

Sources: [Security @ Cisco](<https://devfeed.tech/sources/security-cisco-blogs.md>)

Topics: [Security Operations Center](<https://devfeed.tech/topics/security-operations-center.md>), [Agentic SOC](<https://devfeed.tech/topics/agentic-soc.md>), [Splunk Enterprise Security](<https://devfeed.tech/topics/splunk-enterprise-security.md>), [Logging](<https://devfeed.tech/topics/logging.md>), [Cisco](<https://devfeed.tech/topics/cisco.md>)

Tags: [agentic](<https://devfeed.tech/tags/agentic.md>), [agentic-soc](<https://devfeed.tech/tags/agentic-soc.md>), [ai-canvas](<https://devfeed.tech/tags/ai-canvas.md>), [cisco](<https://devfeed.tech/tags/cisco.md>), [cisco-secure-firewall](<https://devfeed.tech/tags/cisco-secure-firewall.md>), [cisco-talos](<https://devfeed.tech/tags/cisco-talos.md>), [cloud](<https://devfeed.tech/tags/cloud.md>), [conf](<https://devfeed.tech/tags/conf.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [encrypted-visibility-engine](<https://devfeed.tech/tags/encrypted-visibility-engine.md>), [firewall](<https://devfeed.tech/tags/firewall.md>), [firewalls](<https://devfeed.tech/tags/firewalls.md>), [security](<https://devfeed.tech/tags/security.md>), [security-operations-center](<https://devfeed.tech/tags/security-operations-center.md>), [snort](<https://devfeed.tech/tags/snort.md>), [soc](<https://devfeed.tech/tags/soc.md>), [splunk](<https://devfeed.tech/tags/splunk.md>), [splunk-cloud](<https://devfeed.tech/tags/splunk-cloud.md>), [splunk-enterprise-security](<https://devfeed.tech/tags/splunk-enterprise-security.md>), [telemetry](<https://devfeed.tech/tags/telemetry.md>)

## AI overview

At Splunk .conf26, Cisco describes a live SOC built around a multi-stage agentic pipeline, with firewall telemetry feeding Splunk Enterprise Security, autonomous agents accelerating triage, Cisco Cloud Control enforcing confidence gates, and analysts making response decisions. Structured firewall events and encrypted-traffic signals support investigations, while AgenticOps and AI Canvas help administrators manage policies and coordinate incident work.

## Source excerpt

Discover how Cisco Secure Firewall and Cloud Control stream structured Snort 3 and EVE telemetry into Splunk ES to power the .conf26 Agentic SOC pipeline.