AbdulMoiz Lakdawala
I'm a principal consultant in the SOC advisory space, and I've spent the last 6-7 years building and running security operations
from second-line analyst work to architecting SOAR automation to leading SOC and detection engineering programs. I've stood up SOCs from scratch (triage workflows, escalation, the boring-but-critical plumbing), built and tuned detections against MITRE ATT&CK, and spent years automating the busywork analysts hate using Python, SOAR playbooks, and custom connectors.
That automation work is what pulled me into agentic AI — because once you've wired enough response pipelines by hand, you start asking which parts an LLM could actually own.
Session
"Agentic SOC" is the security buzzword of the moment, and most of what you've
heard about it is vendor marketing. This talk strips away the hype and shows you
what an AI agent actually is :a brain (an LLM that reasons), tools (the actions
it's allowed to take), and memory (the context it can retrieve) then maps those
three pieces directly onto components you already run. Using Splunk and a small
live demo, you'll watch a trigger wake an agent, design and run its own queries,
and return a triaged result. You'll leave knowing how to build a basic agentic
detection-and-triage pipeline yourself, and just as importantly where it
breaks and why it isn't the turnkey magic you've been sold.