Splunk .conf26: Tracking the Triage Agent in the Agentic SOC
Cisco, Thursday, October 8th, 2026
Cisco details how the Splunk ES AI Triage Agent prepared evidence for human analysts in the .conf26 event SOC.
Cisco describes running a live agentic SOC at Splunk .conf26 using Cisco, Splunk and Endace telemetry, a blended analyst team and the Splunk Enterprise Security AI Triage Agent.
Its operating principle was that agents prepare the work while people inspect the evidence and decide next steps, with Splunk ES serving as the primary workspace for detections, risk context, investigations and SPL searches.
The same data measured the agent's work, including how many queries it generated, what evidence it considered and how its recommendations moved into human review.