# Security Operations Center Published articles for Security Operations Center. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Introducing automatic remediation policies with Cloudflare CASB DevFeed: [Introducing automatic remediation policies with Cloudflare CASB]() Original publisher: [Read original article]() Author: Abe Carryl Published: 2026-09-11T13:00:00Z Content type: release Language: en Sources: [Cloudflare Blog]() Topics: [Software as a service](), [Cloudflare One](), [Orchestration](), [Authorization]() Tags: [automation](), [casb](), [cloudflare](), [cloudflare-one](), [event-driven](), [oauth](), [orchestration](), [policy](), [reactive](), [saas](), [security](), [security-operations-center](), [zero-trust]() ### AI overview Cloudflare introduces CASB policies that automatically remediate SaaS security findings, including revoking risky file shares and sending webhooks after a finding is detected. ### Source excerpt Cloudflare CASB policies introduce a native automation engine built directly on the Cloudflare developer platform to remediate SaaS risks automatically. Security teams can now design event-driven logic to revoke risky file shares and send webhooks without manual intervention. ## Black Hat USA 2026: Building the Agentic SOC, One Live Event at a Time DevFeed: [Black Hat USA 2026: Building the Agentic SOC, One Live Event at a Time]() Original publisher: [Read original article]() Author: Jessica (Bair) Oppenheimer Published: 2026-09-07T15:00:58Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [Detection engineering](), [SIEM, Security, Observability](), [Threat Hunting & Intel](), [telemetry](), [NOC](), [Malware]() Tags: [agentic-soc](), [black-hat](), [cisco-secure-access](), [cisco-talos](), [cybersecurity](), [duo](), [firewall](), [malware](), [network-operations-center](), [noc](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security](), [telemetry](), [thousandeyes]() ### AI overview Cisco describes its work protecting the Black Hat USA 2026 network alongside NOC leaders and technology partners. The team combined security telemetry and workflows to support visibility, detection engineering, threat hunting, malware analysis, AI protection, and Agentic SOC development. ### Source excerpt Cisco is the Security Cloud Provider for the Black Hat conferences. Learn about the latest innovations for the Agentic SOC. ## Thrown into the SOC: A Black Hat First-Timer's Story DevFeed: [Thrown into the SOC: A Black Hat First-Timer's Story]() Original publisher: [Read original article]() Author: Danny Rodriguez Published: 2026-09-07T15:00:54Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [Incident response](), [incident](), [dashboards]() Tags: [agentic](), [ai](), [ai-agents](), [black-hat](), [cisco-secure-access](), [cisco-talos](), [cisco-xdr](), [cybersecurity](), [dashboards](), [duo](), [firewall](), [incident](), [incident-response](), [network-operations-center](), [noc](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security](), [tools](), [workflows]() ### AI overview A first-time SOC analyst reflects on a short Black Hat NOC rotation, focusing on evidence-based alert triage, uncertainty, and how AI agents can help investigators ask better questions. ### Source excerpt A Black Hat SOC analyst shares how agentic workflows, Splunk ES, packet evidence, and human mentorship accelerated triage & investigation in the NOC/SOC. ## Troubleshooting Wi-Fi at Black Hat USA 2026 with ThousandEyes DevFeed: [Troubleshooting Wi-Fi at Black Hat USA 2026 with ThousandEyes]() Original publisher: [Read original article]() Author: Alex Guckin Published: 2026-09-07T15:00:39Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [Network Operations Center](), [dashboards](), [telemetry](), [Duo]() Tags: [agents](), [black-hat](), [cybersecurity](), [dns](), [duo](), [metrics](), [monitoring](), [network-operations-center](), [noc](), [operations](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security](), [thousandeyes]() ### AI overview A behind-the-scenes account of using ThousandEyes monitoring nodes and dashboards to troubleshoot Wi-Fi performance and roaming issues in the Black Hat USA 2026 Network Operations Center. ### Source excerpt A behind-the-scenes look at troubleshooting Wi-Fi in the Black Hat USA 2026 Network Operations Center with ThousandEyes. ## Building a Risk-Based Secure Network Analytics Detection with Splunk Detection Editor (Alpha) DevFeed: [Building a Risk-Based Secure Network Analytics Detection with Splunk Detection Editor (Alpha)]() Original publisher: [Read original article]() Author: Aditya Sankar Published: 2026-09-07T15:00:32Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [Network](), [incident]() Tags: [black-hat](), [building](), [cybersecurity](), [data](), [dns](), [documentation](), [firewall](), [network-operations-center](), [noc](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security]() ### AI overview This article explains how to use Splunk Detection Editor (Alpha) to develop a Cisco Secure Network Analytics detection and add its alarms as risk events in Splunk Enterprise Security. It covers SPL development and testing, sample data, risk scoring, CIM fields, and investigation drilldowns, with risk-based alerting used to correlate behavior over time. ### Source excerpt At Black Hat USA, we used Splunk Detection Editor Alpha to turn Cisco SNA alarms into risk events with context, drilldowns & analyst-ready investigation paths. ## Black Hat USA 2026: Safeguarding DNS with Secure Access DevFeed: [Black Hat USA 2026: Safeguarding DNS with Secure Access]() Original publisher: [Read original article]() Author: Steve Vida Published: 2026-09-07T15:00:32Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [SIEM, Security, Observability](), [telemetry](), [NOC]() Tags: [apple](), [black-hat](), [cisco-secure-access](), [cisco-security-cloud](), [cisco-talos](), [cisco-xdr](), [cloudflare](), [cybersecurity](), [dns](), [google](), [network-operations-center](), [noc](), [phishing](), [privacy](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security](), [statistics](), [telemetry]() ### AI overview Cisco reports on using Secure Access and DNS telemetry to protect the Black Hat USA 2026 network. The article highlights blocking unapproved encrypted DNS resolvers, DNS request statistics, and activity classified as hacking. ### Source excerpt Cisco is the Security Cloud Provider for the Black Hat conferences, over a decade providing DNS Security. Learn about protecting DNS with Secure Access. ## AI didn't replace our Security Team, it multiplied it DevFeed: [AI didn't replace our Security Team, it multiplied it]() Original publisher: [Read original article]() Author: Andy Gombar Published: 2026-07-17T00:00:00Z Content type: article Language: en Sources: [Webflow Blog]() Topics: [Artificial Intelligence](), [Security](), [Security Operations Center](), [incident](), [SOC](), [log management]() Tags: [ai](), [incident](), [logs](), [operations](), [production](), [security](), [security-operations-center](), [soc]() ### AI overview Webflow describes an engineer-led security detection and response program that uses AI in production to handle more work without a dedicated SOC. AI supports alert triage, context gathering, and post-incident workflows, helping the team manage a 200% increase in detections; one change saved 504 hours in a quarter. ### Source excerpt Webflow's security engineers built AI into triage and post-incident work. One change alone saved 504 hours in a single quarter. ## Preparing for OMB M-26-14: How Datadog supports federal logging maturity DevFeed: [Preparing for OMB M-26-14: How Datadog supports federal logging maturity]() Original publisher: [Read original article]() Author: Chris Leffler; Sophie Wang Published: 2026-06-29T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [SIEM, Security, Observability](), [log management](), [Monitoring](), [threat detection](), [incident](), [Incident response](), [observability](), [Security](), [Security Operations Center](), [Resilience](), [Cybersecurity]() Tags: [bits-ai](), [cloud-siem](), [compliance](), [cybersecurity](), [fedramp](), [govcloud](), [incident-response](), [log-management](), [logging](), [monitoring](), [observability](), [resilience](), [security](), [security-operations-center](), [soc](), [systems](), [telemetry](), [threat-detection](), [workflow-automation]() ### AI overview This article explains how OMB Memorandum M-26-14 changes federal logging guidance from prescriptive requirements to a risk- and maturity-based model. It describes continuous event monitoring and threat hunting, investigation, response, and forensics, including centralized security telemetry, visibility across IT, OT, and IoT environments, threat detection, searchable and retrievable logs, cross-source correlation, incident response, and forensic analysis. It also presents Datadog as a unified observability and security platform for helping agencies meet these requirements. ### Source excerpt Learn how Datadog helps federal agencies prepare for OMB M-26-14 by providing centralized telemetry data, threat detection, and automated incident response. ## Automating SOC workflows with 1Password Enterprise Password Manager DevFeed: [Automating SOC workflows with 1Password Enterprise Password Manager]() Original publisher: [Read original article]() Author: info@1password.com (Clarence Wong) Published: 2026-03-17T00:00:00Z Content type: release Language: en Sources: [Blog on 1Password Blog]() Topics: [SOC](), [API](), [Automation](), [OAuth 2.0](), [Authorization](), [Security](), [Authentication]() Tags: [api](), [apis](), [authentication](), [automation](), [building-1password](), [compliance](), [developers](), [integrations](), [oauth](), [security](), [security-operations-center](), [soc](), [workflows]() ### AI overview 1Password announces the public preview of its Users API for Partners and new security automation integrations for Enterprise Password Manager. The capabilities let SOC teams programmatically suspend or restore users when risk is detected, using OAuth 2.0 authentication and delegated, scoped authorization within coordinated security workflows. ### Source excerpt Introducing our Users API for Partners in public preview and new Security Automation integrations that enable SOC teams to execute programmatic user actions within automated workflows in 1Password Enterprise Password Manager. Modern security teams increasingly rely on integrated security operations center (SOC) workflows that correlate signals and alerts, while orchestrating detection responses in real time. Behind every alert is an identity: a person, a service account, an API key, or an AI agent. However, when remediation requires manual steps, investigation and response slows, increasing security risks. Organizations are also expected to maintain continuous compliance via clearly enforced access controls and auditable processes. Today, 1Password is expanding the 1Password Enterprise Password Manager (EPM) through the public preview of the Users API for Partners, enabling security teams to respond to incidents faster during active security events. Powered by the Users API for Partners, security automation integrations with partners like CrowdStrike, in addition to BlinkOps, Elastic, Sumo Logic, Tines, and Torq enable mutual customers to automatically suspend or restore users in EPM when risk is detected. Together, these capabilities embed identity actions programmatically into coordinated SOC workflows. Moving from visibility to response with the Users API for Partners The Users API for Partners, now in public preview, enables execution of user-related actions within 1Password EPM. The API uses OAuth 2.0-based authentication designed for secure, enterprise-grade security. This enables ecosystem partners to build integrations for 1Password Enterprise Password Manager and use delegated, scoped authorization to list users, suspend access when risk is detected, and restore access after remediation. We're also introducing api.1Password.com as the single access point to 1Password APIs, accessible to ecosystem partners looking to build solutions with 1Password. The Users ## How to build effective runbooks for your SOC DevFeed: [How to build effective runbooks for your SOC]() Original publisher: [Read original article]() Author: Tom Wentworth Published: 2025-03-11T20:16:00Z Content type: tutorial Language: en Sources: [The incident.io Blog]() Topics: [Security Operations Center](), [Incident response](), [Security]() Tags: [analysts](), [audits](), [documentation](), [guide](), [guides](), [how-to](), [incident](), [incident-channel](), [incident-management](), [incident-response](), [onboarding](), [outage](), [post-mortem](), [security-operations-center](), [slack-incident](), [soc](), [training]() ### AI overview A practical guide to creating effective SOC runbooks that standardize incident response, reduce errors, accelerate resolution and analyst onboarding, and support audits and continuous improvement. ### Source excerpt Learn how to create clear, practical runbooks that help your SOC respond faster and with fewer errors. A step-by-step guide for building, maintaining, and improving runbooks that actually get used.