Integrating With Cisco XDR at Black Hat Europe

Investigating indicators of compromise (IOCs) requires a unified view of security data. See how we integrated Cisco XDR with third-party tools and open-source models at Black Hat Europe.

Black Hat Europe: Enhancing Security Operations With Cisco XDR and Foundation-sec-8b-Instruct LLM

Manual triage often slows down incident response. Learn how we integrated an 8-billion parameter security LLM into Cisco XDR to summarize alerts and trace attack paths in real time.

Black Hat Europe 2025: A Decade of Cisco Security Cloud Innovation

Building a secure network for thousands of cybersecurity experts in just three days requires intense collaboration. Discover the hardware, software, and engineering behind the Black Hat Europe NOC.

Black Hat Europe 2025: Firepower IDS Flags Unwanted P2P on Rented Gear

Rented hardware often carries digital baggage from previous users. Discover how our NOC team used JA3 fingerprints and Cisco XDR to track down unauthorized P2P syncing in London.

Securing DNS With Secure Access at Black Hat Europe

For a decade, Cisco has secured Black Hat events with DNS security. Learn how the evolution to Cisco Secure Access provided visibility into 66 million queries and 6,000 unique apps in London.

Lessons Learned from Securing the World’s Largest Cyber Events

Announcing the launch of the Cisco Event SOCs website and the release of our comprehensive Reference Architecture & Operations Guide.

A Newbie’s Perspective: From Curiosity to Confidence, My SOC Story

A new analyst shares their Cisco Live SOC experience, covering quick onboarding, using Cisco XDR and Endace for incident investigation, and building confidence in threat response.

Have You Seen My Domain Controller?

Windows clients expose Active Directory DNS queries on public Wi-Fi, risking OSINT and credential leaks. Learn from Cisco Live SOC observations how to protect clients with VPNs .

Splunk in Action: From SPL to PCAP

Learn how Cisco Live SOC uses Splunk SPL and Endace PCAP to investigate exposed HTTP authentication and Kerberos activity, securing sensitive data on public Wi-Fi networks.

Cisco Live Melbourne 2025 SOC

Cisco Security and Splunk protected Cisco Live Melbourne 2025 in the Security Operations Centre. Learn about the latest innovations for the SOC of the Future.

Cisco Live Melbourne Case Study: Cisco Live TMC Experience and DDoS

Explore a Cisco TME's experience in the Cisco Live SOC, detailing efficient onboarding, incident escalation, and a real-world DDoS attack investigation and response.

GovWare 2025 Security Operations Centre

Cisco Security and Splunk secured the GovWare 2025 network in the Security Operations Centre. Learn about the latest innovations for the SOC of the Future.

From Detection to Deep Dive: Splunk Attack Analyzer and Endace for GovWare 2025 Security

At GovWare 2025, the team leveraged Splunk Attack Analyzer's API to connect to Endace.

Unmasking Attacks With Cisco XDR at the GovWare SOC

During GovWare, Cisco XDR detected 39 incidents. The SOC team conducted analysis and response actions, and reported critical incidents to the GovWare NOC.

Splunk SOAR in Action at the GovWare: Zero-Touch Clear Text Password Response

At GovWare 2025, the SOC team combined ES with Splunk SOAR to fully automate and track the incident response process.

GovWare Captive Portal: (Splash Page)

Cisco provided a splash page for GovWare 2025, a click-through captive portal. Learn how the team did it.

Conference Hopping: Training Attendee Scanning Def Con

Cisco is the Security Cloud Provider to the Black Hat conferences. Learn about the latest innovations for the SOC of the Future at Black Hat USA 2025.

Driving Cisco XDR Integration With Third-Party Partners at Black Hat

Cisco is the Security Cloud Provider to the Black Hat conferences. Learn about the latest innovations for the SOC of the Future at Black Hat USA 2025.

Cisco Secure Firewall: SnortML at Black Hat USA 2025

Cisco is the Security Cloud Provider to the Black Hat conferences. Learn about the latest innovations for the SOC of the Future at Black Hat USA 2025.

Black Hat Investigation: Attempted Exploitation of Registration Server

Cisco is the Security Cloud Provider to the Black Hat conferences. Learn about the latest innovations for the SOC of the Future at Black Hat USA 2025.

The Value of PCAP in Firewall Investigations

Cisco is the Security Cloud Provider to the Black Hat conferences. Learn about the latest innovations for the SOC of the Future at Black Hat USA 2025.

Findings Report From the SOC at RSAC™ 2025 Conference

Cisco Security and Splunk protected RSAC™ 2025 Conference in the Security Operations Center. Learn about the latest innovations for the SOC of the Future.

Email Threat Defense earns AAA rating in SE Labs latest evaluation

SE Labs research identifies the many ways Email Threat Defense successfully defends against advanced email threats in real time to earn the highest rating.

Cisco Live San Diego Case Study: Malware Upatre! (Encrypted Visibility Engine Event)

Cisco Security and Splunk protected Cisco Live San Diego 2025 in the Security Operations Center. Learn about the latest innovations for the SOC of the Future.

Splunk in Action at the Cisco Live San Diego SOC

Cisco Security and Splunk protected Cisco Live San Diego 2025 in the Security Operations Center. Learn about the latest innovations for the SOC of the Future.

Using AI to Battle Phishing Campaigns

Cisco Security and Splunk protected Cisco Live San Diego 2025 in the Security Operations Center. Learn about the latest innovations for the SOC of the Future.

Building an XDR Integration With Splunk Attack Analyzer

Cisco XDR is an infinitely extensible platform for security integrations. Like the maturing SOCs of our customers, the event SOC team at Cisco Live San Diego 2025 built custom integrations to meet our needs. You can build your own integrations using the community resources announced at Cisco Live. It was an honor to work with […]

Cisco Live San Diego Case Study: Hunting Cleartext Passwords in HTTP POST Requests

Cisco Security and Splunk protected Cisco Live San Diego 2025 in the Security Operations Center. Learn about the latest innovations for the SOC of the Future. 

Secure Endpoint Enhancements Elevate Cisco XDR and Breach Protection Suite

Discover how Secure Endpoint enhancements elevate Cisco XDR and the Breach Protection Suite with better visibility and advanced threat defense.

Simplifying Zero Trust: How Cisco Security Suites Drive Value

Discover how Cisco Security Suites are helping organizations achieve zero trust while realizing significant cost savings, improved productivity, and a 110% ROI.

Simplify and Scale Security With Cisco Hybrid Mesh Firewall

Modern enterprises face challenges balancing security with the operational needs. Cisco solves this with Cisco Hybrid Mesh Firewall.

Black Hat Asia 2025 NOC: Innovation in SOC

Cisco is the Security Cloud Provider to the Black Hat conferences. Learn about the latest innovations for the SOC of the Future.

Black Hat Asia 2025: Innovation in the SOC

Cisco is the Security Cloud Provider to the Black Hat conferences. Learn about the latest innovations for the SOC of the Future.

Sign Up for a Tour at the SOC at RSAC™ 2025 Conference

Cisco and Endace provide Security Operations Center services at RSAC™ 2025 Conference. Sign up for a tour and see what happens in the SOC.

Mobile World Congress 2025: SOC in the Network Operations Center

Cisco is the sole supplier of network services to Mobile World Congress, expanding into security and observability, with Splunk.

The Benefits of a Broad and Open Integration Ecosystem

Since inception, Cisco XDR has followed the Open XDR philosophy. We integrate telemetry and data from dozens of Cisco and third-party security solutions.

Black Hat Europe 2024 NOC/SOC: Security Cloud

Cisco is the Official Security Cloud Provider for the Black Hat Network Operations Center (NOC). We work with the other official partners to bring the hardware, software and engineers to build and secure the network, for our joint customer: Black Hat.  Arista: Wired and Wireless Network Equipment  Corelight: Open Network Detection and Response  Palo Alto […]

Simplifying Zero Trust Security for the Modern Workplace

Cisco’s User Protection Suite now includes Identity Services Engine (ISE), enabling organizations to achieve zero trust for the workplace.

Strengthening Docker Security: Best Practices for Resilient Containers

Docker's proliferation has led to some serious vulnerabilities, but you can improve security in Docker containers by following a set of best practices.

GenAI to Advanced Microsegmentation: Secure Workload 3.10 Has It All!

Secure Workload platform has taken a significant leap forward with the launch of its 3.10 release earlier this month packed with Gen AI and many more.

How Cisco Uses the Isovalent Platform to Secure Cloud Workloads

Cisco has integrated the Isovalent platform into our infrastructure to ensure our cloud workloads are protected without compromising on performance.

Cisco Secure Workload: Leading in Segmentation Maturity

As cyber threats evolve, defending workloads in today’s multi-cloud environments requires more than traditional security. Attackers are no longer simply at the perimeter; they may already be inside, waiting to exploit vulnerabilities. This reality demands a shift from just keeping threats out to minimizing their impact when they breach. Cisco Secure Workload is at the […]

Reducing Help Desk Tickets With Cisco’s User Protection Suite

Learn how Cisco’s User Protection Suite tools enable users to quickly and securely get to work.

Business Leader’s Guide for a Successful Microsegmentation Project

One of the most effective strategies for protecting your digital assets is microsegmentation. The success lies in how it's implemented and the planning.

SOC Findings Report From RSA Conference 2024

Discover key insights from the SOC Findings Report at RSA Conference 2024, co-released by Cisco and NetWitness for Cybersecurity Awareness Month.

Cisco Recognized as a Visionary in the 2024 Gartner® Magic Quadrant™ for Endpoint Protection Platforms

Cisco was named a Visionary in the 2024 Gartner MQ for Endpoint Protection Platforms. Learn how we deliver on a vision for bringing together security tools.

Black Hat 2024: SOC in the NOC

The Black Hat Network Operations Center (NOC) provides a high-security, high-availability network in one of the most demanding environments in the world: the Black Hat event. The NOC partners are selected by Black Hat, with Arista, Cisco, Corelight, Lumen, NetWitness and Palo Alto Networks delivering from Las Vegas this year. Cisco is the official Domain […]

Forrester Named Cisco a Leader in the 2024 Microsegmentation Wave

We believe Cisco is the only leader in the Forrester Wave that offers complete network security. Learn how Cisco microsegments everything.

Seamless Secure Work on a Plane

Learn how Cisco’s User Protection Suite provides fast and secure connection to applications, even while traveling.

User Protection Suite Secures Against Talos Top Ransomware Attack Trends

Discover Talo’s first episode of Talos Threat Perspective and how Cisco’s User Protection Suite can provide a layered approach to security.

Stopping Supply Chain Attacks with Cisco’s User Protection Suite

Learn about how Cisco’s User Protection Suite can stop supply chain attacks and protect users.

Stay Compliant: Cisco Secure Workload Introduces State-of-the-art, Persona-based Reporting

Traditional workload security tools often fail to provide metrics tailored to the distinct needs of SecOps, Network Administrators, or CxOs.

Cisco Builds on the CNAPP Movement to Secure and Protect the Cloud Native Application Estate

Enterprise Strategy Group Report Identifies Crucial Requirements for Scalable Security, Multicloud Visibility, and True “Shift Left” DevSecOps

Security, the cloud, and AI: building powerful outcomes while simplifying your experience

Read how Cisco Security Cloud Control prioritizes consolidation of tools and simplification of security policy without compromising your defense.

Black Hat Asia 2024 NOC: Cisco Security Cloud

Protecting Black Hat Asia NOC with Cisco Security Cloud

Empowering Cybersecurity with AI: The Future of Cisco XDR

Learn how the Cisco AI Assistant in XDR adds powerful functionality to Cisco XDR that increases defenders efficiency and accuracy.

Cisco Hypershield – Our Vision to Combat Unknown Vulnerabilities

Cisco Hypershield can help protect organizations agains unknown vulnerabilities by detecting and blocking unknown vulnerabilities in runtime workloads.

Cisco Telemetry Broker (CTB) 2.1 Launch

The ability to generate NetFlow from devices that do not natively produce it along with significant storage efficiency and improved workflows make for a significant update to CTB.

Cisco Telemetry… Read more on Cisco Blogs

Hiding in Plain Sight: How Subdomain Attacks Use Your Email Authentication Against You

For years, analysts, security specialists, and security architects alike have been encouraging organizations to become DMARC compliant. This involves deploying email authentication to ensure their… Read more on Cisco Blogs

Cisco and Nvidia: Redefining Workload Security

There has been an exponential increase in breaches within enterprises despite the carefully constructed and controlled perimeters that exist around applications and data. Once an attacker can access… Read more on Cisco Blogs