Security – Cisco Blog

A Newbie’s Perspective: From Curiosity to Confidence, My SOC Story

A new analyst shares their Cisco Live SOC experience, covering quick onboarding, using Cisco XDR and Endace for incident investigation, and building confidence in threat response.

Security – Cisco Blog

Have You Seen My Domain Controller?

Windows clients expose Active Directory DNS queries on public Wi-Fi, risking OSINT and credential leaks. Learn from Cisco Live SOC observations how to protect clients with VPNs .

Security – Cisco Blog

Splunk in Action: From SPL to PCAP

Learn how Cisco Live SOC uses Splunk SPL and Endace PCAP to investigate exposed HTTP authentication and Kerberos activity, securing sensitive data on public Wi-Fi networks.

Security – Cisco Blog

Cisco Live Melbourne 2025 SOC

Cisco Security and Splunk protected Cisco Live Melbourne 2025 in the Security Operations Centre. Learn about the latest innovations for the SOC of the Future.

Security – Cisco Blog

Cisco Live Melbourne Case Study: Cisco Live TMC Experience and DDoS

Explore a Cisco TME's experience in the Cisco Live SOC, detailing efficient onboarding, incident escalation, and a real-world DDoS attack investigation and response.

Security – Cisco Blog

GovWare 2025 Security Operations Centre

Cisco Security and Splunk secured the GovWare 2025 network in the Security Operations Centre. Learn about the latest innovations for the SOC of the Future.

Security – Cisco Blog

From Detection to Deep Dive: Splunk Attack Analyzer and Endace for GovWare 2025 Security

At GovWare 2025, the team leveraged Splunk Attack Analyzer's API to connect to Endace.

Security – Cisco Blog

Unmasking Attacks With Cisco XDR at the GovWare SOC

During GovWare, Cisco XDR detected 39 incidents. The SOC team conducted analysis and response actions, and reported critical incidents to the GovWare NOC.

Security – Cisco Blog

Splunk SOAR in Action at the GovWare: Zero-Touch Clear Text Password Response

At GovWare 2025, the SOC team combined ES with Splunk SOAR to fully automate and track the incident response process.

Security – Cisco Blog

GovWare Captive Portal: (Splash Page)

Cisco provided a splash page for GovWare 2025, a click-through captive portal. Learn how the team did it.

Security – Cisco Blog

SOC Findings Report From RSA Conference 2024

Discover key insights from the SOC Findings Report at RSA Conference 2024, co-released by Cisco and NetWitness for Cybersecurity Awareness Month.

Security – Cisco Blog

Black Hat 2024: SOC in the NOC

The Black Hat Network Operations Center (NOC) provides a high-security, high-availability network in one of the most demanding environments in the world: the Black Hat event. The NOC partners are selected by Black Hat, with Arista, Cisco, Corelight, Lumen, NetWitness and Palo Alto Networks delivering from Las Vegas this year. Cisco is the official Domain […]

Security – Cisco Blog

Operationalizing our custom “SOC in a Box” at the RSA Conference 2024

Cisco engineers often face the challenge of setting up a Security Operations Center in two days at global events. Aditya Sankar explains the process with our “SOC in a Box” in this blog.

Security – Cisco Blog

Black Hat Asia 2024 NOC: Cisco Security Cloud

Protecting Black Hat Asia NOC with Cisco Security Cloud

Security – Cisco Blog

Cisco & Splunk: A Complete SOC Platform Purpose-Built for the AI-Driven Future

We're excited about the integration of Cisco XDR and Splunk Enterprise Security, creating a SecOps platform that can grow with customers as needs change.

Security – Cisco Blog

Sign up for a Tour at the RSA Conference 2024 SOC

Join the guided tour outside the Security Operations Center, where we’ll discuss real time network traffic of the RSA Conference, as seen in the NetWitness platform. Engineers will be using Cisco S… Read more on Cisco Blogs