Splunk .conf26: Tracking the Triage Agent in the Agentic SOC

Splunk .conf26 gave us the opportunity to operate a live Agentic Security Operations Center (SOC) in the middle of the Splunk community. We brought together Cisco, Splunk, and Endace telemetry, a blended analyst team, and the Splunk Enterprise Security (ES) AI Triage Agent to show how a modern SOC can move from live data to human-validated decisions. The event environment was noisy, temporary, and highly dynamic. Devices, identities, applications, and network behaviors changed throughout the day. That made .conf26 a useful proving ground for a simple operating principle: agents can prepare the work, but people must be able to inspect the evidence and decide what happens next. The blended SOC team operating at Splunk .conf26. The first mission of an event SOC is to protect the network…