Telemetry Gives Agents Context, Not Authority
Cisco’s .conf26 Agentic SOC example connects structured Snort 3 and EVE telemetry from Cisco Secure Firewall and Cloud Control with Splunk ES. This supplies the pipeline with machine-readable security observations that can be analyzed and correlated.
That flow illustrates an important distinction for network operators: access to firewall telemetry is not the same as permission to change a firewall. An agent can help interpret events, organize findings, and formulate a proposed response while an administrator retains authority over consequential actions.
The safest agentic workflow separates observation, recommendation, authorization, execution, and verification.
This separation matters because firewall changes can affect availability as well as security. A recommendation that appears reasonable from one event stream may have wider consequences for applications, routing dependencies, remote access, or compliance obligations.
A Practical Admin-in-the-Loop Workflow
An operator-controlled workflow can be organized around six stages:
Observe. Structured firewall telemetry enters the SOC pipeline and provides the factual basis for analysis.
Interpret. The agent groups relevant events and explains why they may require investigation or a policy response.
Propose. Any suggested firewall action is presented as a reviewable change rather than an immediately executed command.
Approve. An authorized administrator validates the scope, affected assets, operational risk, and intended outcome.
Execute and verify. The approved change is applied through the organization’s controlled process, followed by checks that confirm the expected result.
Retain evidence. The organization preserves the proposal, approval, configuration history, and verification outcome for later investigation or audit.
The approval stage should not be a ceremonial click. Reviewers need enough context to understand what would change, why it was proposed, which assets are affected, and how the previous state can be recovered.
Evidence Trails Make Agentic Decisions Accountable
Agentic workflows can generate many intermediate conclusions. Without an evidence trail, it may be difficult to reconstruct why a particular response was recommended or authorized.
For firewall-related operations, useful records include:
The telemetry that initiated the investigation
The agent’s recommendation and supporting rationale
The identity of the approving operator
The intended configuration change
The configuration state before and after execution
Verification results and any rollback activity
This record supports more than audit readiness. It also helps teams review false positives, improve approval criteria, investigate operational incidents, and distinguish an agent’s recommendation from a human administrator’s decision.
Keep the Control Boundary Explicit
An Agentic SOC does not require operators to surrender control. A sound boundary allows agents to accelerate analysis while reserving high-impact actions for accountable human approval.
Organizations can apply different gates according to risk. A low-impact task might be prepared for rapid review, while a broad policy change should require deeper validation. The essential point is that authorization must remain explicit and traceable.
Rollback readiness is equally important. If a firewall change produces an unexpected outcome, teams need access to the prior configuration and a controlled way to restore it. Agentic speed should never replace configuration discipline.
Where ConnectMyAssets Fits
The Cisco example focuses on a vendor-specific telemetry path into Splunk ES. ConnectMyAssets complements that SOC workflow with an on-prem, vendor-agnostic management and evidence layer for multi-vendor network infrastructure. It does not require the agent to become the final authority over firewall changes.
Relevant ConnectMyAssets modules include:
Firewall Management to give operators a structured view of firewall administration across the managed environment
Backup & History to preserve configuration versions, compare operational history, and provide 1-click rollback when recovery is required
Compliance Engine to assess infrastructure against policies aligned with NIS2, ISO 27001, PCI, CISA, and NIST requirements
Dynamic CMDB to identify affected assets and place a proposed response in infrastructure context
Per-asset CVE Tracking to connect vulnerability exposure with the assets under review
Credential Vault to keep administrative credentials under controlled management
AI Insights, running locally, to assist analysis without turning external AI services into an uncontrolled management plane
Together, these capabilities help establish a clear chain from security observation to reviewed action and retained evidence. Telemetry can inform the SOC, while configuration history, compliance checks, asset context, and rollback remain available to the administrators responsible for the network.
ConnectMyAssets should not be assumed to replace the Cisco-to-Splunk telemetry path described in the source. Its role is to help operators maintain control, traceability, and recoverability around the multi-vendor infrastructure that an agentic workflow may affect.
Source: Cisco Blogs
