Why event SOCs matter
Protect
Reduce risk to core event services with fast detection and triage, plus targeted response that prioritizes availability.
Educate
Share insights with stakeholders, de-escalate false alarms quickly, and reinforce clear policy and response paths in a multi-tenant environment.
Innovate
Use events as a real-world proving ground to refine detections, workflows, integrations, and automations, then carry improvements into products and content.
Who should read this guide
Chief information security officers (CISOs) and security leaders
Quantify risk and value for high-visibility events and venues.
- Use metrics and outcomes to communicate impact
- Make informed investment, staffing, and budget decisions
SOC leaders and incident response (IR) leads
Run repeatable triage and investigation under high noise and limited endpoint control.
- Apply the two-plane operating model and playbook patterns
- Automate triage for event-scale alerts
Security and network operations center teams (SNOC)
Rapidly operationalize a network-centric security posture at event scale.
- Coordinate SOC and NOC workflows and escalation paths
- Manage infrastructure and security event visibility
Event and operations stakeholders
Protect critical services, such as registration, badging, apps, and Wi-Fi.
- Understand what selective, risk-based response looks like in practice
- Ensure business continuity throughout event duration
See the event SOC in action
Video
RSAC 2026: What 10 Years of Conference SOCs Taught Us About AI
RSAC 2026 findings: cleartext, automation, encrypted traffic, and AI agent risks revealed.
Video
Agentic SOC Explained: 5 AI Triage Use Cases for 2026 (Part 1)
The Agentic SOC isn't theoretical anymore. Specific AI use cases are already changing what SOC analysts see and do during an active investigation.
Video
Agentic SOC Explained: 5 AI Triage Use Cases for 2026 (Part 2)
Confirming a threat is just step one. The Agentic SOC is about what happens in the next fifteen minutes: evidence analysis, response decisions, and workflows that improve with every incident.
Video
Inside the event SOC
Watch this behind-the-scenes tour and walk-through of the event SOC.
Podcast
Talos Takes: Inside the Black Hat NOC
This interview features lessons learned while securing one of the highest-noise event networks.
At a glance: The scale that we protect
Metrics shown are based on Cisco Live Americas 2025.
202.9 billion packets captured
Wire data captured for investigation and validation during the event window.
199 TB storage / disk
A total of 199 TB of packet captures written to disk, including IPv6, IPv4, and non-IP traffic.
1.74 billion network sessions
Network metadata at scale for hunting, correlation, and fast pivots when payloads are encrypted.
7.4 TB security logs streamed
Security telemetry written to Splunk Cloud, including perimeter firewall logs, for triage, correlation, and investigation across tools.
62,790 unique devices
High-device churn and transient identities, measured through DHCP, handled with network-centric context and segmentation.
270.4 million DNS requests inspected
DNS security leveraged to spot suspicious resolution, beaconing, newly seen domains, and blocked requests, including 60.1k blocked DNS requests.
2.392 million files analyzed / reconstructed
Files detected or reconstructed from traffic and enriched for investigation when endpoints are unmanaged.
23,368 files sent to Splunk Attack Analyzer
Suspicious files and URLs submitted for detonation, verdicts, indicators, and AI-assisted enrichment.
Guide to rapidly deployed SOCs that secure conferences globally
Get the full guide with reference architecture, operating model, and best practices for running a rapidly deployed SOC under real-world constraints.
Professional resources for your SOC
Connect with sales, support, and partner services to get the very most out of your Splunk- and Cisco-powered SOC.