Threats move at machine speed. Keeping up should not depend on having the biggest budget, the largest team, or the ability to rebuild your security environment.
At Cisco Live APJC, Splunk by Cisco is taking another step toward democratizing the trusted agentic SOC. Enterprise Security (ES) 8.8 brings more agentic assistance into familiar security workflows, while Cloud Connect helps eligible self-managed customers access supported cloud-delivered capabilities without a full cloud migration. Alongside these ES 8.8 enhancements, we are announcing upcoming ES Essentials and Premier edition updates that offer more ways to get started and grow.
The Splunk platform provides the data and context that help agents and analysts work together. The focus is practical: reduce repetitive work across triage, investigation, and response while analysts remain continuously on-the-loop, setting policy and controlling consequential decisions.
Read more about our Cisco Live APJC Announcements
Cloud Connect brings agents to the SOC you already have
Cloud Connect lets eligible self-managed ES customers build on their existing deployment rather than make a full cloud migration their first step. It also helps reduce the burden of managing supporting AI infrastructure.
Cloud Connected support for these agentic capabilities is scheduled for GA on November 18:
Detection and Security Engineering: Detection Builder helps teams build and refine event-based detections.
Investigation and Response: Triage, Guided Response, and Security AI Assistant in agent mode help analysts prioritize alerts, retrieve context, and advance investigations. The Response Agent carries investigation and response-plan context into permitted response actions, with governance and analyst oversight.
For these Cloud Connected capabilities, customers need Splunk Platform 10.4 or later, ES 8.8 or later, and the Splunk Cloud Connect app version 2.0. Edition and agent-specific requirements also apply. Review the agentic AI compatibility information before enabling capabilities.
To get started, an ES administrator can select Configure > General settings > Cloud Connect > Establish Cloud Connect. Follow the setup guide for permissions, network, proxy, and connection requirements.
Prioritize exposure with asset and user context
An alert is easier to prioritize when you understand what it affects. Exposure Analytics in ES 8.8 connects security posture with asset and user context, helping teams decide where to investigate and remediate first.
Entity Posture: Identify security control gaps across assets and users, such as assets missing vulnerability scans or endpoint protection.
Entity Profile: Use context risk and posture to prioritize exposure remediation and elevate the risk of findings associated with higher-risk entities.
Entity Actions: Move from insight to action to address gaps, such as connecting the appropriate teams to handle a ticket, or deploying a SOAR playbook.
Posture and profile insights also appear in Entity Analysis, giving analysts additional context during investigations. Explore the guides for Entity Posture, Entity Profile, and Entity Actions.
Spend less time assembling investigation context
Investigation Aggregation routes related findings and finding groups into cross-domain investigations using configurable rules and timing. Analysts can review related evidence together rather than reconstructing each signal in isolation.
Building on existing Automated Threat Analysis, which brings suspicious emails and artifacts into the investigation workflow, this helps connect evidence to guided response and permitted actions. Analysts remain accountable for consequential decisions.
Learn how to manage findings within investigations.
Put agentic skills to work in familiar workflows
Detection Builder adds customizable instructions to help make guidance more consistent with your SOC procedures. AI chat also supports file attachments, so analysts can provide additional context without leaving the conversation.
Alpha capabilities offer an early look at additional support: AI Threat Graph Detection helps surface suspicious entities from weak or hard-to-correlate signals in cloud deployments; Insider Threat Agents support investigations into risky user behavior; and the Exposure Analytics Agent adds AI-assisted assessment of emerging vulnerabilities and potential detection or remediation actions.
These alpha capabilities are not generally available. Availability and access requirements vary by capability and deployment.
Read more about Detection Builder and AI Threat Graph Detection.
More ways to start and grow with ES Essentials and Premier
The broader Cisco Live APJC announcement also lowers barriers through expanded ES editions:
ES Essentials: Core agentic SOC capabilities, Agentic SOAR, Automated Threat Analysis, and base agentic capacity at the same price point. This gives cost-conscious teams more ways to put agents and embedded automation to work.
ES Premier: Everything in Essentials with advanced specialist agents for autonomous security operations, native UEBA for insider threats, and four times the agentic capacity of Essentials.
These edition changes are planned for ES 8.9 and follow a separate release schedule from ES 8.8. They give teams a path from foundational agentic operations to more advanced protection and greater capacity as their needs grow.
Take the next step toward the trusted agentic SOC
Democratizing the trusted agentic SOC means making it easier to start with what you have and the team you already rely on. Cloud Connect reduces deployment hurdles. ES 8.8 brings more help into everyday workflows. Expanded editions offer more ways to adopt and scale agentic operations, with people in control.
Explore the ES 8.8 release notes and check the agentic AI requirements to plan your next step. Which workflow would you put agents to work on first? Share your questions with the community.
Edition updates and individual capabilities follow their respective release schedules. Capabilities, capacity, and availability vary by edition, deployment, region, and release. Consult product documentation for applicable requirements.
... View more
