# Splunk Enterprise Security Published articles for Splunk Enterprise Security. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Black Hat USA 2026: Building the Agentic SOC, One Live Event at a Time DevFeed: [Black Hat USA 2026: Building the Agentic SOC, One Live Event at a Time]() Original publisher: [Read original article]() Author: Jessica (Bair) Oppenheimer Published: 2026-09-07T15:00:58Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [Detection engineering](), [SIEM, Security, Observability](), [Threat Hunting & Intel](), [telemetry](), [NOC](), [Malware]() Tags: [agentic-soc](), [black-hat](), [cisco-secure-access](), [cisco-talos](), [cybersecurity](), [duo](), [firewall](), [malware](), [network-operations-center](), [noc](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security](), [telemetry](), [thousandeyes]() ### AI overview Cisco describes its work protecting the Black Hat USA 2026 network alongside NOC leaders and technology partners. The team combined security telemetry and workflows to support visibility, detection engineering, threat hunting, malware analysis, AI protection, and Agentic SOC development. ### Source excerpt Cisco is the Security Cloud Provider for the Black Hat conferences. Learn about the latest innovations for the Agentic SOC. ## Thrown into the SOC: A Black Hat First-Timer's Story DevFeed: [Thrown into the SOC: A Black Hat First-Timer's Story]() Original publisher: [Read original article]() Author: Danny Rodriguez Published: 2026-09-07T15:00:54Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [Incident response](), [incident](), [dashboards]() Tags: [agentic](), [ai](), [ai-agents](), [black-hat](), [cisco-secure-access](), [cisco-talos](), [cisco-xdr](), [cybersecurity](), [dashboards](), [duo](), [firewall](), [incident](), [incident-response](), [network-operations-center](), [noc](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security](), [tools](), [workflows]() ### AI overview A first-time SOC analyst reflects on a short Black Hat NOC rotation, focusing on evidence-based alert triage, uncertainty, and how AI agents can help investigators ask better questions. ### Source excerpt A Black Hat SOC analyst shares how agentic workflows, Splunk ES, packet evidence, and human mentorship accelerated triage & investigation in the NOC/SOC. ## Troubleshooting Wi-Fi at Black Hat USA 2026 with ThousandEyes DevFeed: [Troubleshooting Wi-Fi at Black Hat USA 2026 with ThousandEyes]() Original publisher: [Read original article]() Author: Alex Guckin Published: 2026-09-07T15:00:39Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [Network Operations Center](), [dashboards](), [telemetry](), [Duo]() Tags: [agents](), [black-hat](), [cybersecurity](), [dns](), [duo](), [metrics](), [monitoring](), [network-operations-center](), [noc](), [operations](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security](), [thousandeyes]() ### AI overview A behind-the-scenes account of using ThousandEyes monitoring nodes and dashboards to troubleshoot Wi-Fi performance and roaming issues in the Black Hat USA 2026 Network Operations Center. ### Source excerpt A behind-the-scenes look at troubleshooting Wi-Fi in the Black Hat USA 2026 Network Operations Center with ThousandEyes. ## Building a Risk-Based Secure Network Analytics Detection with Splunk Detection Editor (Alpha) DevFeed: [Building a Risk-Based Secure Network Analytics Detection with Splunk Detection Editor (Alpha)]() Original publisher: [Read original article]() Author: Aditya Sankar Published: 2026-09-07T15:00:32Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [Network](), [incident]() Tags: [black-hat](), [building](), [cybersecurity](), [data](), [dns](), [documentation](), [firewall](), [network-operations-center](), [noc](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security]() ### AI overview This article explains how to use Splunk Detection Editor (Alpha) to develop a Cisco Secure Network Analytics detection and add its alarms as risk events in Splunk Enterprise Security. It covers SPL development and testing, sample data, risk scoring, CIM fields, and investigation drilldowns, with risk-based alerting used to correlate behavior over time. ### Source excerpt At Black Hat USA, we used Splunk Detection Editor Alpha to turn Cisco SNA alarms into risk events with context, drilldowns & analyst-ready investigation paths. ## Black Hat USA 2026: Safeguarding DNS with Secure Access DevFeed: [Black Hat USA 2026: Safeguarding DNS with Secure Access]() Original publisher: [Read original article]() Author: Steve Vida Published: 2026-09-07T15:00:32Z Content type: article Language: en Sources: [Security @ Cisco Blogs]() Topics: [SIEM, Security, Observability](), [telemetry](), [NOC]() Tags: [apple](), [black-hat](), [cisco-secure-access](), [cisco-security-cloud](), [cisco-talos](), [cisco-xdr](), [cloudflare](), [cybersecurity](), [dns](), [google](), [network-operations-center](), [noc](), [phishing](), [privacy](), [security](), [security-operations-center](), [soc](), [splunk-cloud](), [splunk-enterprise-security](), [statistics](), [telemetry]() ### AI overview Cisco reports on using Secure Access and DNS telemetry to protect the Black Hat USA 2026 network. The article highlights blocking unapproved encrypted DNS resolvers, DNS request statistics, and activity classified as hacking. ### Source excerpt Cisco is the Security Cloud Provider for the Black Hat conferences, over a decade providing DNS Security. Learn about protecting DNS with Secure Access.