# Zeek Published articles for Zeek. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Do Flow-Generation Tools Matter? Unsupervised Characterization of MQTT Traffic Across Public Datasets DevFeed: [Do Flow-Generation Tools Matter? Unsupervised Characterization of MQTT Traffic Across Public Datasets]() Original publisher: [Read original article]() Author: Mohammed Rashed, Carlos Garc\\'ia-Rubio, Celeste Campo Published: 2026-10-22T04:00:00Z Content type: article Language: en Sources: [arXiv: Cryptography and Security](), [arXiv: Networking]() Topics: [MQTT](), [clustering](), [Internet Traffic]() Tags: [characterization](), [clustering](), [cs-cr](), [cs-ni](), [datasets](), [evaluation](), [feature](), [flow](), [generation](), [mqtt](), [packet](), [performance](), [public](), [reduction](), [security](), [tools](), [traffic](), [zeek]() ### AI overview Flow-generation tools materially affect how MQTT traffic appears in flow-level clustering, so tool choice is an experimental factor alongside dataset and analysis settings. The study generated over 380,000 flows from packet captures in four public datasets using Zeek-flowmeter, Argus, and NTLFlowLyzer, then compared K-means, DBSCAN, and HDBSCAN with and without PCA. It evaluated clustering with Silhouette score and Adjusted Rand Index. Zeek-flowmeter performed best in several settings, especially K-means with PCA reduced to 10 components, but no tool consistently led across datasets, algorithms, and metrics. ### Source excerpt arXiv:2610.29774v1 Announce Type: cross Abstract: Message Queue Telemetry Transport (MQTT) is widely used in IoT environments due to its lightweight publish-subscribe design and suitability for resource-constrained networks. While current MQTT security studies mainly focus on detecting attacks and optimizing classification performance, this work takes a different perspective by presenting a cross-dataset, tool-aware characterization of MQTT traffic at the flow level. This perspective is motivated by the fact that flow-generation is tool-dependent: flows are not directly observed in packet captures, but are constructed through tool-specific decisions about packet grouping, flow termination, and feature export. Using packet captures from 4 public MQTT datasets, we generated over 380K flows with 3 open-access flow-generation tools: Zeek-flowmeter, Argus, and NTLFlowLyzer. We analyzed the tool-specific flows using K-means, DBSCAN, and HDBSCAN, with and without PCA-based dimensionality reduction. We measured clustering quality using 2 metrics: (1) Silhouette score to assess label-independent cluster compactness and separation, and (2) Adjusted Rand Index to measure agreement with available labels. Our results show that the choice of flow-generation tool affects the resulting flow population, feature-space structure, and clustering behavior. Zeek-flowmeter achieves the best performance in several settings, particularly with K-means and PCA reduction to 10 components. Yet, no single tool consistently dominates across all datasets, algorithms, and evaluation metrics. These findings show that flow-level MQTT analysis should treat the dataset, flow-generation tool, preprocessing choices, clustering algorithm, and evaluation metric as interconnected experimental factors. ## Splunk .conf26: Tracking the Triage Agent in the Agentic SOC DevFeed: [Splunk .conf26: Tracking the Triage Agent in the Agentic SOC]() Original publisher: [Read original article]() Author: Christian Cloutier Published: 2026-10-08T15:00:29Z Content type: article Language: en Sources: [Cisco Blogs]() Topics: [Agentic SOC](), [alert triage](), [human in the loop agent](), [Security Operations Center](), [Security](), [Splunk Enterprise Security](), [observability]() Tags: [agentic](), [agentic-soc](), [ai](), [cisco-duo](), [cisco-secure-access](), [cisco-secure-endpoint](), [cisco-secure-firewall](), [cybersecurity](), [security](), [security-operations-center](), [security-telemetry](), [soc](), [splunk](), [splunk-enterprise-security](), [telemetry](), [triage](), [workflows](), [zeek]() ### AI overview At Splunk .conf26, Cisco and its partners operated a live Agentic SOC using Splunk Enterprise Security to combine security, network, and identity telemetry. The Splunk AI Triage Agent gathered evidence and suggested dispositions while human analysts validated findings and made response decisions. A dashboard tracked agent activity, evidence, confidence, and analyst handoffs; the reported metrics describe the conference environment, not product benchmarks. ### Source excerpt How Cisco used Splunk as the SOC data platform at .conf26 to unify security telemetry and track the Splunk AI Triage Agent with human-validated workflows. ## Splunk .conf26: Tracking the Triage Agent in the Agentic SOC DevFeed: [Splunk .conf26: Tracking the Triage Agent in the Agentic SOC]() Original publisher: [Read original article]() Author: Christian Cloutier Published: 2026-10-08T15:00:29Z Content type: news Language: en Sources: [Security @ Cisco]() Topics: [Agentic SOC](), [alert triage](), [Splunk Enterprise Security](), [Security Operations Center](), [human review](), [Threat monitoring](), [agent observability](), [Security]() Tags: [agent](), [agentic](), [agentic-soc](), [ai](), [cisco-duo](), [cisco-secure-access](), [cisco-secure-endpoint](), [cisco-secure-firewall](), [cybersecurity](), [security](), [security-operations-center](), [soc](), [splunk](), [splunk-enterprise-security](), [tracking](), [triage](), [zeek]() ### AI overview At Splunk .conf26, Splunk Enterprise Security served as the shared SOC workspace for combining Cisco, Endace, and convention-center identity, endpoint, network, exposure, and artifact-analysis data. The AI Triage Agent investigated queued findings, gathered evidence, and suggested dispositions and next steps; analysts reviewed the evidence and retained responsibility for decisions and response. An operations dashboard tracked the workflow, reporting 1,503 agent events, 7,605 SPL queries, 26,207 evidence items, 14,279 hypotheses, 11,250 threat-intelligence lookups, and 94% triage analysis coverage. The article presents these as event-specific observations, not product benchmarks. It emphasizes that data onboarding enabled rapid searches and dashboards, and that SOC teams need visibility into agent activity, evidence, confidence, and analyst review to tune workflows. ### Source excerpt How Cisco used Splunk as the SOC data platform at .conf26 to unify security telemetry and track the Splunk AI Triage Agent with human-validated workflows.