By Owen Gallagher, Senior Sales Engineer, Endace
Overview
This year, I had the opportunity to work in a Security Operations Centre (SOC) for the first time in over a decade, at Cisco® Live Amsterdam. I joined the team responsible for monitoring and responding to incidents on the public Wi‑Fi network.
Cisco builds a fully operational SOC at each Cisco Live event, using tools from Cisco, Splunk and Endace to secure the environment. The team is a mix of engineers and analysts from all three companies, with experience ranging from first‑time responders to L3 (also known as Tier 3) analysts. Even though many of us had never worked together before, the teamwork was excellent. Everyone shared knowledge, helped each other understand different technologies and supported one another during investigations.
Because this was my first SOC shift in over 10 years, it took a little time to get into the rhythm of moving from a Cisco XDR Incident notification, gathering evidence, and deciding whether to close or escalate an incident. But after working through a full investigation, things started to click again.
One incident in particular stood out, so I’ll walk through the workflow and how we reached our conclusion.
The Notification
Cisco XDR® reported suspicious activity: a suspicious IP response from an external host. My first task was to understand what this external IP address was and which internal devices it had communicated with on the Wi‑Fi network. The screenshots below show how the alert appeared in Cisco XDR, including the details provided in the incident description.
Identifying the External IP
I used Talos® Intelligence to look up the IP address. Talos showed that the IP was untrusted and already on the block list, which immediately made the incident more important to investigate.
Checking Internal Communication
Next, I moved into Splunk®. By filtering logs from the Cisco Secure Firewall® (running in passive mode), I could see that the suspicious IP had communicated twice with two internal assets. Based on the address range, these devices were on the wireless network.
The logs also showed that, if the firewall had been in active mode, this traffic would have been blocked. The protocol involved was ICMP, meaning these were ping requests.
At this point, I knew what happened and which devices were involved. But I still needed to confirm whether the pings were successful and what the actual packets looked like.
Verifying with Packet Capture
To answer those questions, I turned to Endace, which records all network traffic. Using EndaceVision™, I generated a visualization that showed two 64‑byte packets exchanged between the external IP and the two internal devices. This matched what Splunk was showing.
To dig deeper, I pivoted into Wireshark™, hosted on EndaceProbe™, to inspect the raw packets. Wireshark confirmed two‑way ICMP communication, which gave us the evidence we needed to document the incident accurately
Escalation
I gathered screenshots, packet details and log information and documented in my report in the XDR Incident Worklog. Because this was confirmed communication with an untrusted IP, I escalated the incident to the network team for a perimeter firewall review and to ensure that the IP address was added to the block list.
Final Thoughts
This incident reminded me how important full packet capture is. Logs show that something happened, but packets tell you exactly how it happened and give you the confidence to take the right action.
Working in the Cisco Live SOC after so many years away from this environment was a rewarding experience. The collaboration, the technology and the live investigations made it a great week, and it reinforced why SOC work is so valuable: you get to protect real users in real time and understand the network at a level you can’t get anywhere else.
Acknowledgements
My experience at this event would not have been possible without the great work done by the Cisco Live EMEA SOC team, led by Jessica Oppenheimer and Ivan Berlinson.
Data collected and analyzed was the result of a team, many thanks go to the following team members:
Network Operations Center Liaisons
- Remco Kamerman, Luke Hebditch, Mark Bremner and Scott Neuman
Cisco Security and Splunk SOC Team
- SOC in a Box: Adi Sankar
- Splunk Security Integrations: Paul Pelletier and Kenneth Bouchard, with Josh Wilson and Duane Waddle
- Splunk Threat Researchers: Nasreddine Bencherchali and Paul Pang
- Breach Protection Suite: Mark Pleunes, Ibrahim Yusuf, Piotr Jarzynka, Matt Vander Horst, Yannis Steiakogiannakis and Eric Rennie, with Bilal Qamar
- User Protection Suite: Aaron Woland
- Firewall and Security Cloud Control: Adam Kilgore and Christopher Grabowski
Endace SOC Team
- Co-SOC Leader: Cary Wright
- Endace Engineering: Owen Gallagher, Sundarram Paravastu and Sam Brockelsby
Read related Cisco Team Blogs from the Cisco Live Europe 2026 SOC:
https://blogs.cisco.com/security/emea-soc-2026
For more Endace blogs in our SOC series, see here:
https://blog.endace.com/tag/soc/
Event SOC Website
Visit Cisco’s Event SOC website for full details of the SOC setup, and download the whitepaper written by Jessica Oppenheimer:
https://www.cisco.com/site/us/en/products/security/event-soc-report.html