Uplevelling Black Hat Threat Hunters
Cisco, Tuesday, June 23rd, 2026
Cisco's threat-hunting team upgraded its Black Hat Asia NOC malware workflow, shifting to Splunk Attack Analyzer for sharper detection.
Cisco's threat-hunting team describes upgrading its malware-analysis workflow in the Black Hat Asia 2026 Network Operations Center, transitioning to Splunk Attack Analyzer to replace its older Secure Malware Analytics platform.
The team built a query correlating submission metadata with high-scoring results and enriched findings with network context to investigate threats faster.
Rather than chasing complete coverage, they focused on HTTP submissions, the only protocol with meaningful volume, and filtered noise from internal traffic routed through zScaler.
The resulting detection stream surfaces high-risk submissions while enabling faster dismissal of false positives, illustrating that effective threat hunting prioritizes actionable intelligence over raw data volume.