How AI Is Changing Cybersecurity: Observability, Agentic SOCs and Human Oversight
· 15:35 · Watch on YouTube ↗
Summary
At Splunk.conf16, demos and interviews show how telemetry, observability and AI agents can support security investigations and response. Speakers stress validating AI outputs, managing costs and keeping people responsible for consequential decisions.
Key points
- Telemetry from racing and flight-simulator demos was collected and displayed in dashboards, illustrating how machine data can help people analyze system behavior.
- In Trace Invaders, game enemies represented Kubernetes pods in an e-commerce application; Chaos Mesh was used to inject CPU, network and disk faults for observability demonstrations.
- Cisco data fabric was described as a way to connect and correlate machine data across application, network, infrastructure and security domains for AI use.
- Speakers emphasized providing AI with organizational context, applying data and output guardrails, checking results, and measuring the cost and value of AI agents.
- An agentic SOC was presented as a way to help with detection and response amid high alert volumes. An LSU student-powered SOC was also described as using AI with human oversight.
- A simulated prompt-injection workflow showed Cisco inspection and Splunk bringing investigation information into one view; the transcript explicitly says this was a demonstration, not a real incident.
- Kamal advocated targeted autonomy: automate repetitive work, but keep important judgment calls with people and verify AI-generated answers against evidence.
Article Details
- Topics
- [00:00] Telemetry and observability demonstrations
- [02:25] Kubernetes disruption and Chaos Mesh fault injection
- [04:38] Cisco data fabric and cross-domain data correlation
- [07:19] Student-powered SOC and AI-assisted security training
- [08:11] AI data foundations, guardrails and cost considerations
- [09:41] Agentic SOCs for detection and response
- [11:46] Simulated prompt-injection investigation workflow
- [13:00] Targeted autonomy and human judgment
People
BruceDemonstrated a simulated prompt-injection investigation workflow involving Cisco inspection and Splunk.CraigDescribed LSU's student-powered SOC, where students work with Tech Stream to mitigate threats and use AI with human oversight.HanlinExplained Cisco data fabric's approach to connecting and correlating machine data across domains and preparing it for AI.HeathDemonstrated a game linked to a Kubernetes e-commerce application and described using Chaos Mesh to inject faults and observe system effects.HouseDiscussed the data foundation and guardrails needed for AI, including checking input data and outcomes, and measuring agent costs and value.JessicaDiscussed SOC visibility and correlation across network and endpoint signals, AI assistance, and providing feedback to an AI agent.KamalDiscussed observability for AI and advocated targeted autonomy, with repetitive work automated but important judgment calls left to people.KumodArgued for an agentic SOC to help defenders handle detection, remediation and overwhelming alert volumes.LaylaPresented an example involving infrastructure running AI and observability across the application stack.