Cell World Congress (MWC) Barcelona is without doubt one of the most demanding environments for community and safety operations. With 1000’s of attendees, unmanaged units, and functions interacting in actual time, operational visibility and menace detection should operate flawlessly.
For the twond yr, the Cisco staff leveraged Splunk, as well as to its different safety merchandise, to ship a unified Safety Operations Middle (SOC) and Community Operations Middle (NOC) expertise. Collectively, we used Splunk because the central knowledge platform and integrating telemetry throughout a broad set of Cisco applied sciences.
What made this deployment notably notable was not simply the breadth of integrations, however the pace and adaptability with which we operationalized the atmosphere.
The Structure: A Unified Operations Platform
On the core of the deployment was Splunk Cloud, performing as the one pane of glass for each SOC and NOC workflows.
We ingested knowledge from a number of Cisco platforms, together with:
This structure allowed us to converge historically siloed operational domains right into a single analytics layer, enabling quicker correlation between community occasions and safety incidents.
Constructing NOC Dashboards in an Afternoon
Some of the impactful outcomes was how shortly we had been capable of ship operational visibility following numerous requests from different groups current on the occasion.
Utilizing Splunk’s knowledge platform and visualization capabilities, we had been capable of construct a totally useful NOC dashboard in only a few hours. The dashboard offered:
- Actual-time community utilization and availability
- Consumer connectivity metrics throughout wi-fi and wired environments
- Utility utilization indicators
As a result of all telemetry was collected inside Splunk, creating significant dashboards required minimal transformation work. This highlights a key benefit of utilizing a unified knowledge platform: as soon as ingestion is solved, insights can observe shortly.
Bridging SOC and NOC: From Visibility to Context
Historically, SOC and NOC groups function in parallel, usually utilizing separate instruments and datasets. At MWC, we deliberately broke down that barrier.
By leveraging Splunk because the widespread platform:
- NOC occasions (e.g., latency spikes, utilization tendencies) may very well be correlated with
- SOC indicators (e.g., anomalous visitors patterns, menace detections)
This convergence enabled quicker root trigger evaluation and diminished imply time to decision (MTTR), notably in situations the place efficiency points or visitors anomalies had potential safety implications.
A First: Deploying the Cisco 6160 Firewall in a Public Occasion
A standout facet of this deployment was the usage of the Cisco Safe Firewall 6160—marking its first deployment in a public occasion atmosphere.
Bringing this knowledge into Splunk required a little bit of engineering:
Information Pipeline Design
Due to the dimensions and efficiency traits of the firewall, we applied a structured ingestion pipeline:
- RSYSLOG Server
- Acted because the preliminary log aggregator supply for the firewall
- Dealt with high-throughput syslog ingestion from the 6160
- Offered buffering and normalization capabilities
- Saved knowledge on the file system, offering one other layer of redundancy
- Splunk Heavy Forwarder (HF)
- Consumed logs from recordsdata produced by RSYSLOG
- Utilized parsing, filtering, and metadata enrichment
- Forwarded processed knowledge securely to Splunk Cloud utilizing the S2S protocol
- Splunk Cloud
- Centralized indexing and analytics
- Enabled each SOC and NOC use circumstances
The next diagram illustrates the ingestion pipeline used to reliably transport high-volume firewall telemetry into Splunk Cloud:
Why This Strategy Labored
- Scalability & Resiliency: RSYSLOG absorbed burst visitors with out dropping occasions and created an area copy of log recordsdata
- Flexibility: The Heavy Forwarder allowed us to manage parsing/filtering earlier than ingestion, ought to we have to
- Cloud Integration: Clear separation between on-prem knowledge assortment and cloud analytics
This pipeline ensured dependable ingestion of high-volume firewall telemetry whereas sustaining efficiency and knowledge integrity.
Classes Realized
A number of key takeaways from the deployment:
- Unification accelerates operations
Bringing SOC and NOC knowledge right into a single platform improves operations and makes new insights potential
- Information onboarding is the toughest—and most essential—step
As soon as knowledge is flowing and normalized, constructing dashboards and detections turns into considerably simpler.
- Edge engineering nonetheless issues in cloud-first architectures
Parts like RSYSLOG and Heavy Forwarders stay crucial for dealing with real-world knowledge ingestion challenges.
- Velocity is achievable with the proper abstractions
Constructing a production-grade NOC dashboard in hours—not days—is life like when the platform is designed for it.
Take a look at the classes realized from the Occasion SOCs we deploy all over the world, with the white paper and newest blogs.
We’d love to listen to what you assume! Ask a query and keep linked with Cisco Safety on social media.
Cisco Safety Social Media