Cisco Revolutionizes Security Operations with Agentic AI in Splunk Enterprise

Cisco Unveils Agentic AI-Powered Security Solutions

Cisco Systems Inc. has announced a significant upgrade to its Splunk data platform, introducing agentic artificial intelligence (AI) to enhance both security operations and observability across digital infrastructure 1

1

.

This move marks a major step forward in the evolution of Security Operations Centers (SOCs) and reflects Cisco's commitment to leveraging AI for improved threat detection, investigation, and response (TDIR).

New Splunk Enterprise Security Editions

At the heart of this announcement are two new editions of Splunk Enterprise Security:

1. Essentials Edition: Combines Splunk Enterprise Security 8.2 with the Splunk AI Assistant and Detection Studio, featuring a unified interface 1

   1

   4

   4

   .
2. Premier Edition: Includes all features of the Essentials Edition, plus Splunk Security Orchestration, Automation and Response (SOAR), and Splunk User and Entity Behavior Analytics (UEBA) 1

   1

   4

   4

   .

Both editions leverage AI agents to automate and orchestrate tasks across the TDIR lifecycle, enabling security teams to focus on strategic decision-making while AI handles routine tasks 3

3

4

4

.

Enhanced Observability Features

Cisco has also introduced AI-powered features to the Splunk Observability portfolio, aimed at proactive issue detection and AI system monitoring 1

1

2

2

. These updates include:

• AI-directed troubleshooting in Splunk Observability Cloud and Splunk AppDynamics
• Event iQ in Splunk IT Service Intelligence for automated alert correlation
• AI Agent Monitoring for assessing the quality and cost of large language models
• AI Infrastructure Monitoring to identify service bottlenecks and resource spikes 1

  1

Agentic AI for Security Operations

The introduction of agentic AI in Splunk Enterprise Security represents a paradigm shift in how SOCs operate. AI agents now do more than just orchestrate and automate workflows; they transform manual tasks into proactive, autonomous security operations 4

4

.

This transformation streamlines comprehensive threat management, empowering security teams to act faster and more efficiently.

Future AI-Powered Advancements

Cisco has unveiled plans for additional AI-powered features to be released in the future, including:

• Triage Agent: AI-powered alert evaluation and prioritization
• Malware Reversal Agent: AI-driven analysis of malicious scripts
• AI Playbook Authoring: Natural language translation into functional SOAR playbooks
• Response Importer: AI agents adhering to standard operating procedures
• AI-Enhanced Detection Library and Personalized Detection SPL Generator 4

  4

Cisco Integrations and Availability

To further enhance the SOC capabilities, Cisco is integrating its security solutions with Splunk:

• Isovalent Runtime Security (eBPF) integration for granular workload visibility
• Federated firewall data analytics through Splunk Cloud's Federated Search in AWS S3 1

  1

  4

  4

The Splunk Enterprise Security Essentials Edition is now available globally, while the Premier Edition is in early access. Additional AI-powered capabilities are expected to be available in 2026 4

4

.

This comprehensive update to Splunk's security and observability offerings demonstrates Cisco's commitment to leveraging AI to address the growing complexity of cybersecurity challenges and empower organizations to build more efficient and effective security operations centers.