# Cisco Talos Published articles for Cisco Talos. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Black Hat USA 2026: Building the Agentic SOC, One Live Event at a Time DevFeed: [Black Hat USA 2026: Building the Agentic SOC, One Live Event at a Time]() Original publisher: [Read original article]() Author: Jessica (Bair) Oppenheimer Published: 2026-09-07T15:00:58Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [Detection engineering](), [SIEM, Security, Observability](), [Threat Hunting & Intel](), [telemetry](), [NOC](), [Malware]() Tags: [agentic-soc](), [black-hat](), [cisco-secure-access](), [cisco-talos](), [cybersecurity](), [duo](), [firewall](), [malware](), [network-operations-center](), [noc](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security](), [telemetry](), [thousandeyes]() ### AI overview Cisco describes its work protecting the Black Hat USA 2026 network alongside NOC leaders and technology partners. The team combined security telemetry and workflows to support visibility, detection engineering, threat hunting, malware analysis, AI protection, and Agentic SOC development. ### Source excerpt Cisco is the Security Cloud Provider for the Black Hat conferences. Learn about the latest innovations for the Agentic SOC. ## Thrown into the SOC: A Black Hat First-Timer's Story DevFeed: [Thrown into the SOC: A Black Hat First-Timer's Story]() Original publisher: [Read original article]() Author: Danny Rodriguez Published: 2026-09-07T15:00:54Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [Incident response](), [incident](), [dashboards]() Tags: [agentic](), [ai](), [ai-agents](), [black-hat](), [cisco-secure-access](), [cisco-talos](), [cisco-xdr](), [cybersecurity](), [dashboards](), [duo](), [firewall](), [incident](), [incident-response](), [network-operations-center](), [noc](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security](), [tools](), [workflows]() ### AI overview A first-time SOC analyst reflects on a short Black Hat NOC rotation, focusing on evidence-based alert triage, uncertainty, and how AI agents can help investigators ask better questions. ### Source excerpt A Black Hat SOC analyst shares how agentic workflows, Splunk ES, packet evidence, and human mentorship accelerated triage & investigation in the NOC/SOC. ## Black Hat USA 2026: Safeguarding DNS with Secure Access DevFeed: [Black Hat USA 2026: Safeguarding DNS with Secure Access]() Original publisher: [Read original article]() Author: Steve Vida Published: 2026-09-07T15:00:32Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [SIEM, Security, Observability](), [telemetry](), [NOC]() Tags: [apple](), [black-hat](), [cisco-secure-access](), [cisco-security-cloud](), [cisco-talos](), [cisco-xdr](), [cloudflare](), [cybersecurity](), [dns](), [google](), [network-operations-center](), [noc](), [phishing](), [privacy](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security](), [statistics](), [telemetry]() ### AI overview Cisco reports on using Secure Access and DNS telemetry to protect the Black Hat USA 2026 network. The article highlights blocking unapproved encrypted DNS resolvers, DNS request statistics, and activity classified as hacking. ### Source excerpt Cisco is the Security Cloud Provider for the Black Hat conferences, over a decade providing DNS Security. Learn about protecting DNS with Secure Access. ## When the sensor starts thinking: SnortML, agentic AI, and the evolving architecture of intrusion detection DevFeed: [When the sensor starts thinking: SnortML, agentic AI, and the evolving architecture of intrusion detection]() Original publisher: [Read original article]() Author: Samaresh Kumar Singh Published: 2026-07-06T15:23:34Z Content type: article Language: en Sources: [Stack Overflow Blog]() Topics: [Machine Learning & Artificial Intelligence](), [Security](), [Cisco Talos](), [Network](), [Inference](), [Publish-subscribe pattern](), [Architecture & Design]() Tags: [ai](), [architecture](), [cc-by-sa](), [cisco-talos](), [inference](), [machine-learning](), [network](), [se-stackoverflow](), [se-tech](), [security]() ### AI overview The article examines how SnortML adds local machine-learning inference to Snort 3's intrusion-detection pipeline. It contrasts signature-based detection, which provides precise coverage for known exploits, with machine-learning detection aimed at identifying novel or modified attack behavior. It also places SnortML alongside the broader rise of agentic AI in network defense, while treating the two as developments operating at different architectural layers. ### Source excerpt Signature-based detection has always known what it was looking for. Machine learning and autonomous agents are changing the question entirely, shifting from "does this match a known pattern?" to "does this actually make sense in context?" ## Cisco Talos empowers threat researchers while reducing TCO by 75% with ClickHouse Cloud DevFeed: [Cisco Talos empowers threat researchers while reducing TCO by 75% with ClickHouse Cloud]() Original publisher: [Read original article]() Author: ClickHouse Published: 2026-06-15T00:00:00Z Content type: article Language: en Sources: [ClickHouse Blog]() Topics: [clickhouse](), [Cisco Talos](), [Threat Research](), [Cybersecurity](), [data](), [Cloud](), [databricks](), [Amazon S3](), [parquet](), [Amazon Web Services](), [Kubernetes](), [Serverless]() Tags: [api](), [aws](), [cisco-talos](), [clickhouse](), [cybersecurity](), [data](), [databricks](), [event-driven](), [kubernetes](), [parquet](), [s3](), [serverless]() ### AI overview Cisco Talos migrated a nearly 2-trillion-row, 2 PB threat-intelligence dataset from self-managed ClickHouse to ClickHouse Cloud on AWS with zero downtime and a complete data match. The move reduced storage costs by about 90% and total cost of ownership by about 75%. ### Source excerpt Cisco Talos runs a threat intelligence reputation service on ClickHouse Cloud, classifying file hashes so researchers can make fast, accurate security decisions. ## Marriott Deploys Cisco Umbrella DNS-Layer Security Across Nearly 5,000 Properties to Block Access to CSAM DevFeed: [Marriott Deploys Cisco Umbrella DNS-Layer Security Across Nearly 5,000 Properties to Block Access to CSAM]() Original publisher: [Read original article]() Author: Negisa Taymourian Published: 2024-03-12T08:00:00Z Content type: article Language: en Sources: [OpenDNS]() Topics: [Security](), [Cisco](), [Security & compliance, Cloud security]() Tags: [cisco](), [cisco-talos](), [cloud](), [cloud-security](), [customer-focus](), [deployment](), [dns](), [dns-layer-security](), [dns-security](), [scalability](), [security](), [security-service-edge](), [sse](), [threat-intelligence]() ### AI overview The article describes Marriott's deployment of Cisco Umbrella DNS-layer security across nearly 5,000 properties to block access to child sexual abuse materials and other malicious or unwanted domains. It highlights deployment speed, scalability, guest-network performance, manageability, and Cisco Talos threat intelligence. ### Source excerpt Marriott has rapidly deployed Cisco DNS-layer security across thousands of properties to advance human rights by limiting access to CSAM materials. The post Marriott Leads the Way in the Fight to Protect Children Online appeared first on Cisco Umbrella.