# Cisco Talos

Cisco Talos is Cisco's threat intelligence research organization focused on security expertise and protection.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## When the sensor starts thinking: SnortML, agentic AI, and the evolving architecture of intrusion detection

DevFeed: [When the sensor starts thinking: SnortML, agentic AI, and the evolving architecture of intrusion detection](<https://devfeed.tech/articles/when-the-sensor-starts-thinking-snortml-agentic-ai-and-the-evolving-architecture-of-intrusion-detection-2187.md>)

Original publisher: [Read original article](<https://stackoverflow.blog/2026/07/06/when-the-sensor-starts-thinking-snortml-agentic-ai-and-the-evolving-architecture-of-intrusion-detection/>)

Author: Samaresh Kumar Singh

Published: 2026-07-06T15:23:34Z

Content type: article

Language: en

Sources: [Stack Overflow Blog](<https://devfeed.tech/sources/stack-overflow-blog.md>)

Topics: [Machine Learning & Artificial Intelligence](<https://devfeed.tech/topics/machine-learning-artificial-intelligence.md>), [Security](<https://devfeed.tech/topics/security.md>), [Cisco Talos](<https://devfeed.tech/topics/cisco-talos.md>), [Network](<https://devfeed.tech/topics/network.md>), [Inference](<https://devfeed.tech/topics/inference.md>), [Publish-subscribe pattern](<https://devfeed.tech/topics/pubsub.md>), [Architecture & Design](<https://devfeed.tech/topics/architecture-design.md>)

Tags: [ai](<https://devfeed.tech/tags/ai.md>), [architecture](<https://devfeed.tech/tags/architecture.md>), [cc-by-sa](<https://devfeed.tech/tags/cc-by-sa.md>), [cisco-talos](<https://devfeed.tech/tags/cisco-talos.md>), [inference](<https://devfeed.tech/tags/inference.md>), [machine-learning](<https://devfeed.tech/tags/machine-learning.md>), [network](<https://devfeed.tech/tags/network.md>), [se-stackoverflow](<https://devfeed.tech/tags/se-stackoverflow.md>), [se-tech](<https://devfeed.tech/tags/se-tech.md>), [security](<https://devfeed.tech/tags/security.md>)

### AI overview

The article examines how SnortML adds local machine-learning inference to Snort 3's intrusion-detection pipeline. It contrasts signature-based detection, which provides precise coverage for known exploits, with machine-learning detection aimed at identifying novel or modified attack behavior. It also places SnortML alongside the broader rise of agentic AI in network defense, while treating the two as developments operating at different architectural layers.

### Source excerpt

Signature-based detection has always known what it was looking for. Machine learning and autonomous agents are changing the question entirely, shifting from "does this match a known pattern?" to "does this actually make sense in context?"

## Cisco Talos empowers threat researchers while reducing TCO by 75% with ClickHouse Cloud

DevFeed: [Cisco Talos empowers threat researchers while reducing TCO by 75% with ClickHouse Cloud](<https://devfeed.tech/articles/cisco-talos-empowers-threat-researchers-while-reducing-tco-by-75-with-clickhouse-cloud-5043.md>)

Original publisher: [Read original article](<https://clickhouse.com/blog/cisco>)

Author: ClickHouse

Published: 2026-06-15T00:00:00Z

Content type: article

Language: en

Sources: [ClickHouse Blog](<https://devfeed.tech/sources/clickhouse-blog.md>)

Topics: [clickhouse](<https://devfeed.tech/topics/clickhouse.md>), [Cisco Talos](<https://devfeed.tech/topics/cisco-talos.md>), [Threat Research](<https://devfeed.tech/topics/threat-research.md>), [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [data](<https://devfeed.tech/topics/data.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>), [databricks](<https://devfeed.tech/topics/databricks.md>), [Amazon S3](<https://devfeed.tech/topics/amazon-s3.md>), [parquet](<https://devfeed.tech/topics/parquet.md>), [Amazon Web Services](<https://devfeed.tech/topics/aws.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [Serverless](<https://devfeed.tech/topics/serverless.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [aws](<https://devfeed.tech/tags/aws.md>), [cisco-talos](<https://devfeed.tech/tags/cisco-talos.md>), [clickhouse](<https://devfeed.tech/tags/clickhouse.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [data](<https://devfeed.tech/tags/data.md>), [databricks](<https://devfeed.tech/tags/databricks.md>), [event-driven](<https://devfeed.tech/tags/event-driven.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [parquet](<https://devfeed.tech/tags/parquet.md>), [s3](<https://devfeed.tech/tags/s3.md>), [serverless](<https://devfeed.tech/tags/serverless.md>)

### AI overview

Cisco Talos migrated a nearly 2-trillion-row, 2 PB threat-intelligence dataset from self-managed ClickHouse to ClickHouse Cloud on AWS with zero downtime and a complete data match. The move reduced storage costs by about 90% and total cost of ownership by about 75%.

### Source excerpt

Cisco Talos runs a threat intelligence reputation service on ClickHouse Cloud, classifying file hashes so researchers can make fast, accurate security decisions.