Most network designs are validated by review: Capable people read the diagram and agree on what will happen when something fails. This session will show an alternative approach using an AI coding assistant: Write the design as a machine-readable spec, have the assistant generate both the Cisco Modeling Labs topology and the failure test plan from that same spec, run the tests, and find out which of your assumptions survive contact with packets.

This session will open with the method: what a spec-driven workflow actually is, what belongs in the spec and what does not, and why the topology and the test plan have to come from one source of truth. It will follow with two demos. The first demo is small enough to follow along at home: a three-node topology built live from a thirty-line spec. The second is a twenty-node dual-site firewall design drawn from a real enterprise internet edge migration, which we will break one component at a time: Pull the site interconnect, kill an edge router, and watch the traffic generator. In the original engagement one of those tests had exposed an inbound blackhole that had already cleared two rounds of human design review. The finding changed the design.

You'll leave with the repository and enough working knowledge to start building and testing your own designs.

Building an AI agent that can troubleshoot a network is one thing. Trusting a group of them to operate in production is something else entirely.

This session will walk through using a swarm of network-focused AI agents to explore why agent observability matters and how Splunk Agent Observability helps to understand what those agents are actually doing. We will look at:

• How Splunk Agent Observability gives visibility into agent behavior, tool calls, latency, and cost
• How multiple network agents work together across troubleshooting, remediation, and validation
• How to identify when agents get stuck, become expensive, or make bad decisions

Because if you’re going to hand more of network operations over to AI agents, “it seems to be working” probably isn’t good enough.

Modern network operations still suffer from a familiar gap: Implementation teams build sophisticated automation, while day-two operations inherit fragile runbooks, tribal knowledge, and tool sprawl. This session will show how that gap can be closed by combining Cisco Workflows with AI agents—turning complex orchestration into simple, repeatable operations that both implementation engineers and operations teams can share.

Cisco Workflows is a low- to no-code orchestrator designed to convert multi-step network tasks into governed, reusable workstreams. Rather than forcing operations teams onto a different stack, the same methodology used by implementation engineers can be obfuscated, simplified, and operationalized. The result is a common toolset for design, validation, change, and day-two execution—reducing adoption friction, shortening time-to-value, and making orchestration a living operational capability instead of a one-time project artifact.

The session is built around live demos that hide complexity without hiding control. You will see how AI-assisted workflows can augment and help solve common challenges deterministically.

Security teams often struggle with rule bloat, high-risk migrations, and slow manual changes on legacy firewalls. In this fast-paced, live-demo session, you'll discover how Cisco Security Cloud Control, Cloud-Delivered Firewalls, and the Model Context Protocol (MCP) bridge legacy infrastructure to autonomous AI operations.

This session will walk through the complete modernization lifecycle by converting legacy Cisco ASA configurations into modern Snort 3 policies, resolving policy conflicts with Security Cloud Control’s Policy Analyzer, and building a custom MCP server using an official Python library. You will see an AI agent interact with Cisco Cloud-Delivered Firewalls to audit policy drift, provision network objects, and trigger deployments in real time using natural language.

You'll leave with a practical modernization playbook and a ready-to-use MCP server repository for lab and production environments.

What if onboarding Cisco integrations in Splunk could be as repeatable as deploying code—guided by AI Skills, validated before changes are applied, and designed for the realities of Splunk Cloud, Splunk Enterprise, and hybrid environments?

This 45-minute live demo explores the Splunk and Cisco Skills repository, an open-source project that turns common Splunk and Cisco integration tasks into reusable, agent-driven workflows. The repository combines product-specific skill instructions, templates, shell automation, deployment guidance, and validation routines so Splunk administrators can move from an initial request to usable telemetry with less guesswork and fewer handoffs.

This session will follow a realistic administrator workflow. First, we’ll identify the correct skill for the target Cisco product and deployment model. Next, we’ll use a product-specific template to collect the required non-secret details—such as hostnames, account names, organization IDs, regions, indexes, and feature choices. We’ll show how credentials and tokens remain separated from configuration and source control. From there, we’ll render and review the proposed setup, install or configure the integration, and validate that data is actually flowing into Splunk.

The live demo will highlight Cisco data center networking, Cisco Meraki, and Cisco Intersight workflows. We'll also show how the same operating pattern can be extended across Cisco technologies and Splunk workflows, including customer-managed collectors, Splunk Observability Cloud, AppDynamics, ThousandEyes, and related operational use cases. Along the way, we’ll demonstrate how structured validation can surface missing inputs, certificate issues, compatibility considerations, and other deployment friction before they become larger problems.

This session is intended for Splunk administrators, technical practitioners, solution architects, and anyone responsible for onboarding data sources or maintaining Cisco integrations. You will leave with a practical blueprint for applying AI skills to standardize integration onboarding, protect sensitive configuration, reduce reliance on tribal knowledge, and accelerate time to reliable, actionable visibility in Splunk.

AI applications introduce a new operational challenge: traditional infrastructure metrics may show that systems are healthy while users experience slow responses, failed requests, or inconsistent results.

This session presents a practical approach to assuring and troubleshooting hybrid AI inference environments. Using a representative enterprise workflow, the session follows a request from user through the network, AWS infrastructure, model inference, and the final user experience.

Attendees will learn how to correlate LLM metrics such as time to first token, token-generation rate, latency, and error rates with application telemetry, cloud dependencies, and network-path data from Cisco ThousandEyes. The session will also demonstrate how Splunk can help combine these data sources into a practical workflow for detection, correlation, root-cause analysis, and operational response.

The goal is to move from “the model is slow” to evidence-based answers about where the actual problem occurs.

Participants will learn how to innovate using AI, existing Network Platforms Controllers APIs, Model Context Protocol Servers, and Cloud Control Studio.

We will review existing network management challenges and demonstrate how MCP enables intelligent, context-aware automation, supporting your existing Infrastructure-as-Code workflows, or create with ease new AI Agents.

The second part of the presentation will review how to unify network management with Cisco Cloud Control, and the opportunities to innovate with Studio, a simplified experience to build your Agents to manage your network infrastructure.

Prior experience with AI, MCP servers, AI Agents is helpful, but not required. Demos and Agents, MCP server sample code for network automation will be included.