# One Cisco in Action: Inside the Agentic SOC at .conf26

DevFeed: [One Cisco in Action: Inside the Agentic SOC at .conf26](<https://devfeed.tech/articles/one-cisco-in-action-inside-the-agentic-soc-at-conf26-77376.md>)

Original publisher: [Read original article](<https://blogs.cisco.com/security/conf26-agentic-soc/>)

Author: Jessica (Bair) Oppenheimer

Published: 2026-10-08T15:00:39Z

Content type: article

Language: en

Sources: [Security @ Cisco](<https://devfeed.tech/sources/security-cisco-blogs.md>)

Topics: [Agentic SOC](<https://devfeed.tech/topics/agentic-soc.md>), [Splunk Enterprise Security](<https://devfeed.tech/topics/splunk-enterprise-security.md>), [Security Operations Center](<https://devfeed.tech/topics/security-operations-center.md>), [Cisco](<https://devfeed.tech/topics/cisco.md>), [Cisco XDR](<https://devfeed.tech/topics/cisco-xdr.md>), [Cisco Talos](<https://devfeed.tech/topics/cisco-talos.md>)

Tags: [agentic](<https://devfeed.tech/tags/agentic.md>), [agentic-soc](<https://devfeed.tech/tags/agentic-soc.md>), [black-hat](<https://devfeed.tech/tags/black-hat.md>), [cisco](<https://devfeed.tech/tags/cisco.md>), [cisco-live](<https://devfeed.tech/tags/cisco-live.md>), [cisco-talos](<https://devfeed.tech/tags/cisco-talos.md>), [conf](<https://devfeed.tech/tags/conf.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [enterprise-security](<https://devfeed.tech/tags/enterprise-security.md>), [security](<https://devfeed.tech/tags/security.md>), [security-operations-center](<https://devfeed.tech/tags/security-operations-center.md>), [soc](<https://devfeed.tech/tags/soc.md>), [splunk](<https://devfeed.tech/tags/splunk.md>), [splunk-cloud](<https://devfeed.tech/tags/splunk-cloud.md>), [splunk-enterprise-security](<https://devfeed.tech/tags/splunk-enterprise-security.md>)

## AI overview

The article describes Cisco and Splunk's live Agentic SOC at .conf26, which used Cisco Cloud Control, Splunk Enterprise Security, security telemetry, AI agents, and packet capture to monitor event traffic. It recounts how analysts investigated and remediated a fake-Corepack infostealer incident affecting 15 venue endpoints, with AI-supported correlation and human-led containment.

## Source excerpt

Read how Cisco Cloud Control and Splunk Enterprise Security powered the live Agentic SOC at .conf26 to deliver unified TDIR across live event traffic.