Au cœur du SOC Agentique : De l’alerte à la réponse guidée avec Splunk Enterprise Security et Cisco

Alexandre Argeris, a systems engineer at Splunk covering Quebec and the Maritimes, walks a security-operations-center audience through Splunk's shift to an 'agentic SOC' built on Splunk Enterprise Security and integrated with Cisco Cloud Control. He frames the case for change around alert fatigue, the SOC talent shortage, and detection tools that generate more events than analysts can absorb, then argues for narrow, task-specific AI agents under human-defined access and supervision rather than general-purpose chatbots. He walks through agents mapped to each stage of an investigation: an AI-powered data-onboarding agent, a Detection Builder agent that writes SPL search rules from a plain-language description, a procedure agent that ingests existing incident playbooks, a SOAR playbook-configuration agent that builds and self-tests automation workflows from a conversation, and triage and investigation-summary agents. He stresses that agents run inside the Splunk platform to limit data leaving the environment, and that Cisco Cloud Control adds Splunk-monitored, non-Cisco event context to Cisco's own investigations. An audience Q&A covers agent orchestration, data confidentiality with external versus local LLMs, and realistic limits on eliminating alert fatigue.