Category: Network Security

Govware 2025: Full packet capture reveals suspicious traffic masquerading as MPEG in HTTP POSTS

Original Entry by : Barry "Baz" Shaw

By Barry “Baz” Shaw, Senior Engineering Manager, Technology Partner Programs, Endace

Barry

At GovWare 2025, Suspicious Video traffic was investigated using Full Packet Capture, revealing the traffic was in fact not video at all, but instead a potential threat masquerading as video to evade detection. Without packet capture this traffic would have gone unnoticed.

In this blog we reveal what led us to be suspicious, how we analyzed the traffic, and the clues that lead us to believe it may be threat traffic to a concerning destination.

Endace Always-on Packet Capture

Two of Endace’s newest EP94C8 EndaceProbes were installed in the GovWare SOC to provide full packet capture to support the conference SOC directives of Protect, Educate, and Innovate.  Full packet capture provides unique insight into all activities on the network, delivering critical context and evidence for Incident Response and Threat Hunting teams.

The EndaceProbes each hosted three VMs that were running Zeek and delivering critical log data into Splunk.  Custom Zeek script additions provided additional valuable details around clear text passwords in email and HTTP, and the use of insecure protocols.  Zeek was also used for file-carving and automated submission of objects to Splunk Attack Analyzer and a beta of Endace’s new Vault API used in a Cisco XDR automated workflow was field tested.   

SOC Findings and Lessons Learned

During a cursory review of the file mime-types submitted to Splunk Attack Analyzer, a number of video files were observed.  To ascertain the contents of these files, an interactive session was launched in Splunk Attack Analyzer and VLC used to open them.  Nothing was observed in these media files, and no codec information was available, which lead to the question “Why did Zeek carve these files in the first place?”

A custom search in Splunk to identify more information about files with mime-type video/mpeg or video/mpv showed a curious pattern emerging.  A number of these files were approximately 500 bytes in length – far too small to be a legitimate media file.  All these small files were associated with various conference WIFI addresses and all being sent to the same remote IP address.

A bespoke investigation into these IP addresses in Cisco XDR indicated that there were connections to known and suspected malicious sites:

Suspicious hosts in CIsco XDR

Using EndaceVision the relationship between these addresses could also be seen in the Chords chart where 5 infected hosts were communicating with a single external address. The thicker lines indicated larger data transfers:

Using the chord chart to visualize conversations

Pivoting to the hosted Wireshark instance available on all EndaceProbes quickly revealed the data flows from the conference WIFI to the remote address to be in the form of HTTP POSTs:

Following the HTTP streams in Wireshark then revealed an interesting User-Agent:

Following TCP Streams shows a User Agent listed as "IM-SIMUHTTP"

A search of the web indicated that these Host and User-Agent strings were used by a now-defunct windows application called SIM Instant Messenger.  The domain associated with this application was also defunct and indications are that the project was discontinued in 2008. 

On the face of it, this could be an old instant messaging client contacting a central server, but the age of the application and the fact the contents were impossibly small MPEG files continued to raise suspicion.  Information relevant to the destination IP address also raised doubts that this was legitimate messaging traffic, even within the context of being embedded inside another application.

The question about how these MPEG files were carved was soon answered by Wireshark:

Looking at the HTTP posts in Wireshark

The first eight bytes of each of these POSTs were associated with different MPEG magic numbers, a few of which are shown below:

List of Magic Numbers seen in Wireshark analysis of the packets

Notice that the bytes following the magic numbers in the screenshot above are the same, and there was a lot of repetition of content across all the traffic to the external address – could this be compromised endpoints obfuscating their phone home connections to a C2?  The short, directional and periodic nature of these connections could also be seen to support this theory.

Unfortunately, no further context was able to be extracted from this small sample of connections, but further monitoring of small POSTs with MPEG contents external sites would be warranted on a corporate network – we will certainly be looking for similar patterns at future events.

It’s important to note that this threat investigation could not have been conducted without continuous full packet capture provided by EndaceProbe.  At no point was this traffic flagged or alerted on, therefore a triggered PCAP or metadata only solution would not have captured these packets and their presence on the network and the risk associated with them would have gone unseen by the network operators.  When securing the most important networks in the world it’s critical to have full packet capture for visibility to defend against attackers that will go to extreme lengths to obfuscate their activity.

Acknowledgements

Once again, our thanks go to the Cisco team lead by @Jessica Oppenheimer for the opportunity to include EndaceProbes in the GovWare SOC architecture.  The SOC team is a collection of Cisco experts across many domains who were a pleasure to work and innovate with and we came away with a great appreciation for power of the Cisco Security tools.  The Endace team was able to prove out integration innovations from previous SOC events and test these in earnest in a real-world environment in preparation for making them generally available to the market.

About GovWare

GovWare Conference and Exhibition is the region’s premier cyber information and connectivity platform, offering multi-channel touchpoints to drive community intel sharing, training, and strategic collaborations.

A trusted nexus for over three decades, GovWare unites policymakers, tech innovators, and end-users across Asia and beyond, driving pertinent dialogues on the latest trends and critical information flow. It empowers growth and innovation through collective insights and partnerships.

Its success lies in the trust and support from the cybersecurity and broader cyber community that it has had the privilege to serve over the years, as well as organisational partners who share the same values and mission to enrich the cyber ecosystem.

Read more

For more blogs in our Endace SOC series, see here:
https://blog.endace.com/tag/soc/ 

Episode #64 with Steve Fink talking about building next-Gen SOCs with AI, automation, and resilience

Original Entry by : Michael Morris

In the Packet Forensic Files, Episode 64, Michael talks to Steve “Fink”, CTO and CISO at Secure Yeti

By Michael Morris, Director of Global Business Development, Endace

Michael Morris, Director of Global Business Development, Endace

Building Next-Gen SOCs with AI, Automation, and Resilience

In this episode of The Packet Forensic Files, I’m joined by Steve “Fink” Fink, CTO and CISO at Secure Yeti, and the mastermind behind the Security Operations Centers (SOCs) and Networks Operations Centers (NOCs) that power some of the biggest cybersecurity events in the world, including Black Hat, RSA Conference, and Cisco Live.

With more than 26 years in cybersecurity, beginning with pen-testing the FBI, Fink has built and operated some of the most complex SOCs in the world. He shared his insights into what it takes to design resilient, scalable, and future-ready security environments.

It All Starts with the Packets

Fink believes that true visibility begins at the packet level:

“If you don’t have the context of your network, it’s almost impossible to conduct a valid investigation or build an effective response plan.”

By combining full packet capture with contextual data and up-to-date asset inventories, analysts gain the visibility necessary to detect and respond in real-time.

Automation, AI, and Resilience

At Secure Yeti, Fink has automated nearly every SOC function up to Tier 4 using agentic AI, handling over 97% of the workload. This automation enables scalability, consistency, and around-the-clock response, freeing human analysts to focus on higher-level investigations.

Resilience is also a core design principle. Fink ensures redundancy at every level, emphasizing that even if one component fails, “the whole thing shouldn’t descend into chaos.”

Collaboration and Interoperability

At events like Black Hat and RSA, Fink brings together traditionally competing vendors, from firewalls and SIEMs to XDR and packet capture platforms, to collaborate within a single SOC. That cooperation, he says, fuels product innovation and real-world interoperability.

At Endace, we share Fink’s philosophy that packets provide the ultimate source of truth for understanding what’s happening on the network and driving smarter, faster investigations.

Don’t miss this episode as Fink shares how operational excellence and AI-driven security are being redefined.

PFF Ep 64 Steve Fink Video Thumbnail

Other episodes in the Secure Networks video/audio podcast series are available here. Or listen to the podcast here or on your favorite podcast platform.

Endace Packet Forensics Files: Episode #63

Original Entry by : Michael Morris

In Episode 63, Michael talks to Jack Chan, Vice President, Product Management at Fortinet

By Michael Morris, Director of Global Business Development, Endace

Michael Morris, Director of Global Business Development, Endace

Why NDR is Evolving—And What Enterprises Should Demand From It

In this episode of The Packet Forensic Files, I spoke with Jack Chan, VP of Product and Field CTO at Fortinet, about what sets a strong Network Detection and Response (NDR) solution apart. Jack explained that while many vendors claim to offer NDR, the best solutions help security teams see deep into their networks, spot threats early, and look back in time to understand what really happened before and after an incident.

Jack pointed out that most companies already have too many security tools creating alerts. That’s why it’s so important for NDR to work well with other tools like EDR—so SOC teams know which alerts really matter. He also shared how AI and machine learning are helping to detect threats even in encrypted traffic, and how newer tech like generative AI is making it easier for analysts to investigate issues without writing complex queries.

We talked about the benefits of using NDR alongside firewalls. Since NDR is passive, it can show you how clean or risky your network is without disrupting anything. But when NDR spots a threat, teams need to decide—should it trigger an automatic response or wait for human approval? Jack recommends using automation carefully, with some human oversight.

Finally, Jack reminded us that technology alone isn’t enough. Security starts with people—whether it’s developers writing secure code or staff avoiding risky clicks. No matter how advanced your tools are, the human factor still plays a huge role in keeping networks safe.

Don’t miss this episode as Jack shares practical tips, real-world examples, and a clear-eyed view of where the NDR space is heading.

 

Other episodes in the Secure Networks video/audio podcast series are available here. Or listen to the podcast here or on your favorite podcast platform.

Threat actors are recording PCAPs, maybe you should too?

Original Entry by : Barry "Baz" Shaw

By Barry “Baz” Shaw, Senior Engineering Manager, Technology Partner Programs, Endace

Barry

On Aug 29th, Government Cybersecurity agencies from around the world released a joint advisory detailing how nation-state threat actors are compromising networks across the world, particularly in the US, Australia, Canada, New Zealand and the UK: www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a www.darkreading.com/cybersecurity-operations/cisa-fbi-nsa-warn-chinese-global-espionage-system

These attacks are primarily focussed on telecommunications, government, lodging and military networks, and the tactics, techniques, and procedures (TTP) overlaps with APT (Advanced Persistent Threat) actors linked to multiple China-based entities. These threat actors are exploiting well-known vulnerabilities in VPN servers and web user interfaces on switches and routers.  Even devices not owned by targets of interest are being compromised in order to provide additional attack pathways to the intended targets.  Upon gaining a foothold in a network, persistence is achieved by modifying ACLs, opening services on non-standard ports to avoid detection, and tunnelling C2 and exfiltrated data to obfuscate malicious activity.

Of note in this particular instance is the use of PCAP collection on the target network by the threat actors.  Once they’ve gained a foothold on the network infrastructure, the native capability of some routers to record PCAPs is then used to capture TACACS+ (authentication) traffic.  When transmitted in clear text (or weakly encrypted) this authentication traffic exposes users credentials which can then be used to elevate the attacker’s access and enable them to move laterally across the network.

The use of network sniffing to extract credentials in authentication traffic is a common technique of threat actors (attack.mitre.org/versions/v17/techniques/T1040/).  As we continue to see the stubborn use of unencrypted and weakly-encrypted protocols on networks, these insecure communications remain prime targets for credential gathering.  Additionally, the uses of maliciously collected PCAP is evolving, with the ArcaneDoor campaign taking this a step further and exfiltrating captured PCAPs for remote analysis (attack.mitre.org/campaigns/C0046/).  Exfiltrated PCAPs may contain anything from authentication data to file objects.

PCAP data is the ground-truth for what is happening on the network, and it is the source that all other network and security telemetry is derived from.  Threat actors know this and value the raw unfiltered and unsampled intel that it provides about the target.  This begs the question: if your adversaries see value in collecting PCAPs off your network, shouldn’t you be capturing full PCAP too!? 

If you are not recording your network traffic, your security team has less visibility into network activity than your attackers – which makes the job of protecting your network impossibly difficult. With PCAP at their fingertips, SOC analysts can see exactly what’s happening on the network, making for faster, more accurate investigation and resolution of security incidents – as this excellent blog post from Cisco’s Steve Nowell describes.

That full PCAP data is so valuable to attackers also highlights a stark warning that wise defenders should heed. PCAP data must be protected and secured to the highest standards.  Can you trust packet capture solutions that aren’t FIPS and Common Criteria certified? Or packet capture sources that can’t be properly locked down and protected from access by attackers?

For more blogs in our Endace SOC series, see here:
https://blog.endace.com/tag/soc/ 

Network Visibility in Action: Endace and Cisco Drive SOC Defenses at RSAC 2025

Original Entry by : Cary Wright

By Cary Wright, VP Product Management, Endace

Cary Wright, VP Product Management, Endace

Uncovering insights from the 6th Annual Security Operations Center at RSA Conference

For the sixth consecutive year, a dedicated Security Operations Center (SOC) monitored the RSA Conference (RSAC) network, protecting a dynamic environment serving over 40,000 attendees.  A collaboration between Endace and Cisco (and other security partners), the SOC provided real-world insights into current threat landscapes and security challenges, and demonstrated the critical importance of comprehensive network monitoring and real-time threat detection in large-scale environments.

The 2025 SOC team consisted of:

  • 5 Endace analysts
  • 9 Cisco/Splunk analysts
  • 3 dedicated threat hunters
  • 3 managers

 

Network Monitoring at Unprecedented Scale

The SOC captured and analyzed an astounding volume of data flowing through the conference network:

  • 40+ billion packets captured (more than double the 19 billion from the previous year)
  • 33 TB of packet data (up from 17TB)
  • Peak bandwidth usage of 3.4 Gbps (up from 2.2 Gbps)
  • 615 million total sessions (increased from 383 million)
  • 793 million logs captured
  • 287,000 files extracted with 26,374 submitted for deeper analysis

Endace’s VP of Product Management Cary Wright explained the scope: “We tapped into the network and recorded everything—all the packets that traveled across that network—approximately 30 terabytes of data over the course of the whole conference.”

The Technical Architecture: Integration in Action

The SOC implemented a sophisticated, multi-layered security architecture centered around visibility and integration:

    1. Network Capture Layer: EndaceProbe appliances performed full packet capture, creating a complete record of all network activity.
    2. Log Generation and Analysis: The Endace systems generated metadata through tools like Zeek, which was then forwarded to Splunk and Cisco security tools for analysis.
    3. Threat Detection Systems: Cisco Secure Firewall provided intrusion detection (running in non-blocking mode to avoid disrupting vendor demonstrations while still identifying potential threats).
    4. Integration Layer: All components were interconnected, allowing analysts to pivot seamlessly from alerts directly to the relevant packet data, providing context for rapid investigation.
    5. File Analysis Pipeline: Files transmitted across the network were extracted and analyzed: 
      • 287,000+ files extracted from network traffic
      • 26,374 files sent to Splunk Attack Analyzer
      • 7,546 files forwarded to Cisco Malware Analytics for in-depth examination

Key Security Findings and Trends

The SOC’s monitoring revealed several concerning security trends:

1. Declining Encryption Levels

One surprising finding was a drop in the percentage of encrypted traffic, from approximately 80% in 2024 to 74% in 2025. This regression toward “the dark past” of unencrypted communications creates significant security vulnerabilities.

More troubling was the increase in weak encryption (TLS 1.0/1.1) to 40% of encrypted traffic, along with the continued presence of plaintext password transmission.

2. Plaintext Passwords Continue

Though trending downward over the years, plaintext passwords remain a persistent problem, showing that the power of a strong password is nothing without an encrypted communication protocol!

      • 2020: 96,361 cleartext passwords (2,178 unique accounts)
      • 2022: 55,525 cleartext passwords (2,210 unique accounts)
      • 2023: 36,910 cleartext passwords (424 unique accounts)
      • 2024: 20,916 cleartext passwords (99 unique accounts)
      • 2025: 1,807 cleartext passwords (87 unique accounts)
3. Legacy Protocol Persistence: POP3 Refuses to Die

The SOC discovered continued use of vulnerable legacy protocols:

      • POP3 (unencrypted email retrieval)
      • Non-secured SMTP (email transmission)
      • Unencrypted IMAP
4. Advanced Threat Techniques

The SOC identified several sophisticated attack techniques, including:

      • New domain generation algorithm (DGA) approaches using combinations of 2-3 random words
      • Command and control (C2) traffic
      • Cleartext transmission of sensitive data
      • Unsecured translation services transmitting text and audio in the clear
      • Exposed CCTV camera feeds

The Value of Complete Network Visibility

The collaborative SOC deployment at RSAC 2025 demonstrated the crucial role that full packet capture plays in modern security operations. By capturing and analyzing every packet traversing the network, security teams gained:

      • Complete visibility into all network communications
      • Contextual evidence for security investigations
      • Rapid response capabilities through integrated tools
      • Retrospective analysis of historical network data

The integration between Endace’s packet capture technology and Cisco’s security suite enabled a powerful workflow: alerts from security tools could be immediately investigated by pivoting directly to the relevant network traffic, dramatically reducing investigation time.

Key Takeaways for Security Teams

Based on the RSAC 2025 SOC experience, organizations should consider these best practices:

      • Deploy comprehensive network monitoring with full packet capture for complete visibility
      • Implement integrated security tools that work together seamlessly
      • Focus on encryption enforcement to protect sensitive data in transit
      • Eliminate legacy protocols that transmit data in cleartext
      • Use personal VPNs when connecting to public networks
      • Keep operating systems patched and maintain robust configuration management

The Endace and Cisco-powered SOC at RSAC 2025 demonstrated that comprehensive network visibility remains fundamental to effective security operations. As threats grow more sophisticated, the ability to see, analyze, and respond to every packet traversing the network becomes increasingly critical.

By integrating full packet capture with advanced security analytics, organizations can build security operations centers that provide both the breadth and depth of visibility needed to detect and respond to today’s most sophisticated threats.

This blog post is based on information shared during the “PROTECTED: The 6th Annual Report from the SOC at RSAC” session at RSA Conference 2025.

For more blogs in our Endace SOC series, see here:
https://blog.endace.com/tag/soc/ 

Black Hat 2025 NOC

Original Entry by : Michael Morris

Elevating Incident Response with the Ultimate Network Forensics – PCAP Or It Didn’t Happen

By Michael Morris, Director of Global Business Development, Endace and Barry Shaw, Senior Engineering Manager, Technology Partner Programs in Fusion Integration, Endace

This year, the Black Hat NOC team was armed with a new cyber-superpower. Always-on full packet capture was deployed to record the entire conference traffic to support the Black Hat NOC/SOC directives of Protect, Educate, and Innovate.  Full packet capture provides an indelible record of all network activity, which is critical for security operations’ investigations.

Two EndaceProbes with a combined storage of 266 TB were installed in the Black Hat US 2025 NOC to capture every packet in full, from show start to the final closing. Fast access to full packet data for any event allowed the talented Black Hat NOC team to quickly understand threats and security risks for the attendees of the Black Hat conference. 62TB of captured network packet data was heavily leveraged by the Black Hat NOC security analysts with more than 1000 PCAP downloads from Endace systems during the 6 days of network operation.

Endace Fusion integrations provided the glue between the Cisco Security suite, Palo Alto Networks, Corelight and the packet data on the EndaceProbes, enabling analysts to quickly pivot from Splunk/Splunk Cloud, Cisco XDR, Cisco Firepower, Cisco SNA, Palo Alto Networks XSIAM, Panorama NGFWs, and Corelight Investigator through to EndaceVision and hosted Wireshark.  When access to historical full PCAP is available in a seamless integration, security analysts are empowered with the ease of contextual access, and this simplifies the use of PCAP data, where previously it could be seen to be cumbersome to use.

The EndaceProbes each hosted two VMs that were running Zeek and delivering critical log data into Splunk.  Custom Zeek script additions provided additional valuable detail around clear text passwords in email and HTTP, shining a light on the surprisingly persistent use of insecure protocols, and ultimately driving automation to streamline the response to these.

NOC Innovations

At the Black Hat 2025 NOC, a number of key innovations were developed and enhanced with Endace and integrations we have with Cisco, Palo Alto Networks, and Corelight. These innovations advanced and simplified the use of Endace packet data in incident response and threat hunting investigations. Endace packet data is an invaluable forensic tool for NOC/SOC analysts in getting to the root cause of complex threat investigations to be 100% sure of the impact of malicious activity.

The first integration innovation developed by Matt Vander Horst – Cisco and Barry (Baz) Shaw – Endace, and Anantha Srinivasan -Endace was a Cisco XDR automation that gathered up and preserved the packet evidence for each security alert. Links to the packet evidence and flow records CSV appear in the XDR worklog, and a link to the Endace Investigation is provided should the analyst need to investigate other related packet evidence, see screenshot below. This required new APIs on Endace, and a new workflow automation within XDR, that were both developed during the days and nights of the Black Hat NOC week.

The second integration innovation, developed by Josh Randall (#Mr Mongo) – Palo Alto Networks and Anantha  Srinivasan – Endace, created a direct pivot from any Palo Alto Networks XSIAM incident that launches an EndaceVision investigation focused on the packets related to that security event. This integration enabled analysts leveraging the power of the XSIAM SIEM platform to get directly to Endace ‘s packet-level forensics in the context of any XSIAM incident.   You can see the pivot integration in the bottom right of the Cortex XSIAM screenshot below.

The third integration innovation involved streaming packet Metadata from EndaceProbe into Splunk Cloud to create a dashboard with various insights. This included Encrypted vs Unencrypted traffic volumes, passwords in the clear, Encryption Strength, and general network traffic levels. We displayed this on a central dashboard for everyone to view during the conference, see below.

The final innovation we brought to the NOC was a change to the Endace packet search capability that resulted in a near x50 improvement in packet search and download times. With fast and easy access to full PCAP and a little instruction on how to use EndaceVision, the enthusiasm for using packet data to understand and resolve incidents really took off.

SOC Findings and Lessons Learned

The feedback we received from many NOC team members is that streamlining access to full packet data opened new possibilities for threat hunting and incident response. Fast and easy access to packet data from the other security tools in the NOC really helped our understanding of many incidents.

We found there is still too much information carried across the network in the clear, with around 8% unencrypted. This leaves users vulnerable to information leakage, credential stealing, account hijacking, social engineering and outright fraud.  The use of POP, IMAP, HTTP and other encrypted protocols is still too high.

Our biggest learning was the power of collaboration is dramatically amplified when everyone is together in a dark room, with pumping music, audio free 90s movies playing in the background, with the common goals of protect, educate and innovate! It is amazing how well everyone worked together, such collaboration between different vendors is incredible to experience and will only strengthen cybersecurity for all our users.

Acknowledgements

Our thanks to the Black Hat NOC team, led by Grifter, Bart, and Fink, for the opportunity to include EndaceProbes in the Black Hat NOC architecture.  Also, a special thank you to Jessica Bair Oppenheimer for including Endace in the Cisco security stack architecture for Black Hat, sharing the Cisco screens and space in the NOC. The NOC team includes some of the most experienced security experts across the industry. Everyone was a pleasure to work and innovate with and we came away with a great appreciation for the power of working in such a welcoming and open environment.  The close collaboration resulted in the Endace team leaving with not only ideas for further integrations and workflow improvements, but also working prototypes that were developed and proved out during the SOC.

About Black Hat
Black Hat is the cybersecurity industry’s most established and in-depth security event series. Founded in 1997, these annual, multi-day events provide attendees with the latest in cybersecurity research, development, and trends. Driven by the needs of the community, Black Hat events showcase content directly from the community through Briefings presentations, Trainings courses, Summits, and more. As the event series where all career levels and academic disciplines convene to collaborate, network, and discuss the cybersecurity topics that matter most to them, attendees can find Black Hat events in the United States, Canada, Europe, Middle East and Africa, and Asia. For more information, please visit www.Black Hat.com.

For more blogs in our Endace SOC series, see here:
https://blog.endace.com/tag/soc/

Endace Packet Forensics Files: Episode #62

Original Entry by : Michael Morris

In Episode 62, Michael talks to Jessica (Bair) Oppenheimer, Cisco’s Director of Security Operations

By Michael Morris, Director of Global Business Development, Endace

Michael Morris, Director of Global Business Development, Endace

What does it take to run a world-class Security Operations Center (SOC) in today’s high-stakes, high-speed cybersecurity landscape?

In this episode of the Packet Forensic Files, I talk with Jessica (Bair) Oppenheimer, Cisco’s Director of Security Operations, for an in-depth look at next-generation Security Operations Centers (SOCs). Jessica shares her expertise from securing high-stakes events like the Paris 2024 Summer Olympics, the NFL Super Bowl, Black Hat, Cisco Live and RSAC Conferences, as well as years of experience at Guidance Software, ThreatGrid and Cisco.

I asked Jessica what differentiates the “next gen” SOC from traditional SOC models. She talks about some of the “high-visibility “SOCs that she’s been working with as part of the Cisco Security Operations team, and her experience bringing together highly-skilled people from multiple organizations, keeping them motivated, equipping them with all the tools and telemetry they need, so they can collaborate and innovate.

Jessica talks about why people, innovation, and smart use of AI as an enabler for SOC teams are critical to creating an agile and responsive SOC team. She sees AI’s key role is in speeding up analysis, detection, and threat-hunting, and providing analysts with detailed context around incidents so they can make informed decisions more quickly. It can also help analysts to quickly build automation tasks in response to threats they’re seeing so they can respond faster. That makes analysts more productive and effective, and in turn frees them up to do more proactive threat hunting like investigating some of the less obvious signals that might indicate potentially serious threats.

This episode is a must-watch for cybersecurity professionals who want to stay ahead of evolving threats – particularly those in security operations. It is jam-packed with insights on balancing automation with human expertise and establishing the key KPIs for SOC success.

Other episodes in the Secure Networks video/audio podcast series are available here. Or listen to the podcast here or on your favorite podcast platform.

Cisco Live US 2025 SOC – PCAP or it didn’t happen!

Original Entry by : Barry "Baz" Shaw

By Barry “Baz” Shaw, Senior Engineering Manager, Technology Partner Programs, Endace

Barry

Elevating Incident Response with the Ultimate Network Forensics

After a successful SOC @ RSAC2025, our team was stoked to be invited to help Cisco run the SOC at Cisco Live US (CLUS). We jumped at the chance to work with the Cisco team again. It was a great opportunity to innovate while helping Cisco protect and educate the attendees of the conference. Plus, the Cisco team is a lot of fun to hang out with—there’s a very infectious vibe in the SOC that has everyone buzzing for the entire week.

Packet capture is essential in the SOC. It provides an indelible record of all network activity, which is invaluable to the SOC team when investigating threats or security risks—hence the phrase, “PCAP or it didn’t happen.” For CLUS, we deployed two EndaceProbes with a combined storage of 864TB to continuously record all network activity delivered via 2 x 10GbE SPAN ports. This gave us the capacity to record at least several weeks of full network packet data—covering more than the entire duration of the show.

Endace Fusion integrations provided the glue between the Cisco Security suite and the packet data on the EndaceProbes, enabling analysts to quickly pivot from Splunk Enterprise Security/Splunk Cloud, Cisco XDR, Cisco Firepower, and Cisco Secure Network Analytics (SNA) through to EndaceVision and hosted Wireshark. When access to historical full PCAP is available in a seamless integration, security analysts are empowered with the ease of contextual access, and this simplifies the use of PCAP data, where previously it could be seen to be cumbersome to use.

The EndaceProbes each hosted two VMs that were running Zeek and delivering critical log data into Splunk. Custom Zeek script additions provided additional valuable detail around clear text passwords in email and HTTP, shining a light on the heavy use of insecure protocols, and ultimately driving automation to manage the unexpected volume. File-carving was enabled, and over 750,000 files were reconstructed from packet data, with over 40,000 samples submitted to Splunk Attack Analyzer (SAA) via Endace’s automatic submission software. SAA then sent over 12,000 files to Secure Malware Analytics (formerly Threat Grid) for dynamic analysis of the behavior.

SOC Findings and Lessons Learned

The SOC team was surprised and initially overwhelmed at the volume of unencrypted traffic on the network. Logging of passwords was coupled with a Cisco XDR automation that created an incident on each detection. This resulted in a heavy workload identifying and notifying users to educate and protect them in the future. The Splunk team developed a creative automated solution to notify users that the SOC detected their use of insecure protocols.

We even found a version of POP that was news to us all—APOP. This hashes the server timestamp in the response header with the user’s password to create a password digest. While this obscures the password, it only delays its inevitable retrieval, all the while the actual message bodies are still transferred in plain text!

In the theme of plain text passwords, reviewing the connections associated with one of these sessions showed a large number of file downloads in the Zeek log generated on EndaceProbe.  This was one of many clients that used the free conference Wi-Fi to download Windows update files, but after filtering out the cab files in a Splunk search, we found a suspicious-looking file:

A search on this filename in SAA confirmed the presence of a malware download by this unfortunate user, whom the SOC team made every effort to identify.

There were also a few notable occasions where Secure Firewall alerts indicated intrusion attempts, which, after a pivot to EndaceVision, were pulled up in Wireshark for further analysis. One alert of note was a “BROWSER-IE Microsoft Internet Explorer Chakra.dll Array.filter type confusion attempt” indicating a malicious web server was trying to exploit a vulnerability in IE. 

A review of the PCAP noted that the target client was, in fact, running Safari on MacOS X.

This indicated that even if the web server was launching a legitimate attack, the client was not vulnerable to this attempt and therefore no further action was required. This highlights the value of full PCAP, packets in related sessions that don’t trigger alerts can offer valuable insight and context to security analysts. This allows rapid determinations to be made with confidence.

Read more about the SOC at CLUS 25 on Cisco’s Blog here:

https://blogs.cisco.com/security/cisco-live-san-diego-2025-soc

Acknowledgements

Our thanks to the Cisco team, led by Jessica Bair-Oppenheimer and Steve Fink, for the opportunity to include EndaceProbes in the Cisco Live SOC architecture. The SOC team is a collection of Cisco experts across many Cisco solutions who were a pleasure to work with and innovate with.  We came away with a great appreciation for the power and ease of use of the Cisco Security tools. The close collaboration resulted in the Endace team leaving with not only ideas for further integrations and workflow improvements, but also prototype integration extensions that were developed and proved out during the SOC.

To learn more about all the ways Endace integrates with Cisco, check out:  https://www.endace.com/cisco.

For more blogs in our Endace SOC series, see here:
https://blog.endace.com/tag/soc/