# Thrown into the SOC: A Black Hat First-Timer's Story

DevFeed: [Thrown into the SOC: A Black Hat First-Timer's Story](<https://devfeed.tech/articles/thrown-into-the-soc-a-black-hat-first-timer-s-story-8410.md>)

Original publisher: [Read original article](<https://blogs.cisco.com/security/bhusa-2026-soc-first-timer/>)

Author: Danny Rodriguez

Published: 2026-09-07T15:00:54Z

Content type: article

Language: en

Sources: [Security @ Cisco Blogs](<https://devfeed.tech/sources/security-cisco-blogs.md>)

Topics: [Incident response](<https://devfeed.tech/topics/incident-response.md>), [incident](<https://devfeed.tech/topics/incident.md>), [dashboards](<https://devfeed.tech/topics/dashboards.md>)

Tags: [agentic](<https://devfeed.tech/tags/agentic.md>), [ai](<https://devfeed.tech/tags/ai.md>), [ai-agents](<https://devfeed.tech/tags/ai-agents.md>), [black-hat](<https://devfeed.tech/tags/black-hat.md>), [cisco-secure-access](<https://devfeed.tech/tags/cisco-secure-access.md>), [cisco-talos](<https://devfeed.tech/tags/cisco-talos.md>), [cisco-xdr](<https://devfeed.tech/tags/cisco-xdr.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [dashboards](<https://devfeed.tech/tags/dashboards.md>), [duo](<https://devfeed.tech/tags/duo.md>), [firewall](<https://devfeed.tech/tags/firewall.md>), [incident](<https://devfeed.tech/tags/incident.md>), [incident-response](<https://devfeed.tech/tags/incident-response.md>), [network-operations-center](<https://devfeed.tech/tags/network-operations-center.md>), [noc](<https://devfeed.tech/tags/noc.md>), [security](<https://devfeed.tech/tags/security.md>), [security-operations-center](<https://devfeed.tech/tags/security-operations-center.md>), [soc](<https://devfeed.tech/tags/soc.md>), [splunk-cloud](<https://devfeed.tech/tags/splunk-cloud.md>), [splunk-enterprise-security](<https://devfeed.tech/tags/splunk-enterprise-security.md>), [tools](<https://devfeed.tech/tags/tools.md>), [workflows](<https://devfeed.tech/tags/workflows.md>)

## AI overview

A first-time SOC analyst reflects on a short Black Hat NOC rotation, focusing on evidence-based alert triage, uncertainty, and how AI agents can help investigators ask better questions.

## Source excerpt

A Black Hat SOC analyst shares how agentic workflows, Splunk ES, packet evidence, and human mentorship accelerated triage & investigation in the NOC/SOC.