Cell World Congress (MWC) Barcelona is without doubt one of the most demanding environments for community and safety operations. With hundreds of attendees, unmanaged units, and purposes interacting in actual time, operational visibility and menace detection should operate flawlessly.
For the twond 12 months, the Cisco crew leveraged Splunk, as well as to its different safety merchandise, to ship a unified Safety Operations Heart (SOC) and Community Operations Heart (NOC) expertise. Collectively, we used Splunk because the central knowledge platform and integrating telemetry throughout a broad set of Cisco applied sciences.
What made this deployment notably notable was not simply the breadth of integrations, however the pace and adaptability with which we operationalized the surroundings.
The Structure: A Unified Operations Platform
On the core of the deployment was Splunk Cloud, appearing as the only pane of glass for each SOC and NOC workflows.
We ingested knowledge from a number of Cisco platforms, together with:
This structure allowed us to converge historically siloed operational domains right into a single analytics layer, enabling sooner correlation between community occasions and safety incidents.
Constructing NOC Dashboards in an Afternoon
One of the vital impactful outcomes was how rapidly we have been capable of ship operational visibility following varied requests from different groups current on the occasion.
Utilizing Splunk’s knowledge platform and visualization capabilities, we have been capable of construct a totally useful NOC dashboard in only a few hours. The dashboard offered:
- Actual-time community utilization and availability
- Consumer connectivity metrics throughout wi-fi and wired environments
- Software utilization indicators
As a result of all telemetry was collected inside Splunk, creating significant dashboards required minimal transformation work. This highlights a key benefit of utilizing a unified knowledge platform: as soon as ingestion is solved, insights can comply with rapidly.
Bridging SOC and NOC: From Visibility to Context
Historically, SOC and NOC groups function in parallel, usually utilizing separate instruments and datasets. At MWC, we deliberately broke down that barrier.
By leveraging Splunk because the frequent platform:
- NOC occasions (e.g., latency spikes, utilization tendencies) could possibly be correlated with
- SOC indicators (e.g., anomalous site visitors patterns, menace detections)
This convergence enabled sooner root trigger evaluation and diminished imply time to decision (MTTR), notably in eventualities the place efficiency points or site visitors anomalies had potential safety implications.
A First: Deploying the Cisco 6160 Firewall in a Public Occasion
A standout facet of this deployment was using the Cisco Safe Firewall 6160—marking its first deployment in a public occasion surroundings.
Bringing this knowledge into Splunk required a little bit of engineering:
Knowledge Pipeline Design
Due to the dimensions and efficiency traits of the firewall, we applied a structured ingestion pipeline:
- RSYSLOG Server
- Acted because the preliminary log aggregator supply for the firewall
- Dealt with high-throughput syslog ingestion from the 6160
- Offered buffering and normalization capabilities
- Saved knowledge on the file system, offering one other layer of redundancy
- Splunk Heavy Forwarder (HF)
- Consumed logs from recordsdata produced by RSYSLOG
- Utilized parsing, filtering, and metadata enrichment
- Forwarded processed knowledge securely to Splunk Cloud utilizing the S2S protocol
- Splunk Cloud
- Centralized indexing and analytics
- Enabled each SOC and NOC use circumstances
The next diagram illustrates the ingestion pipeline used to reliably transport high-volume firewall telemetry into Splunk Cloud:
Why This Method Labored
- Scalability & Resiliency: RSYSLOG absorbed burst site visitors with out dropping occasions and created a neighborhood copy of log recordsdata
- Flexibility: The Heavy Forwarder allowed us to regulate parsing/filtering earlier than ingestion, ought to we have to
- Cloud Integration: Clear separation between on-prem knowledge assortment and cloud analytics
This pipeline ensured dependable ingestion of high-volume firewall telemetry whereas sustaining efficiency and knowledge integrity.
Classes Realized
A couple of key takeaways from the deployment:
- Unification accelerates operations
Bringing SOC and NOC knowledge right into a single platform improves operations and makes new insights potential
- Knowledge onboarding is the toughest—and most vital—step
As soon as knowledge is flowing and normalized, constructing dashboards and detections turns into considerably simpler.
- Edge engineering nonetheless issues in cloud-first architectures
Elements like RSYSLOG and Heavy Forwarders stay crucial for dealing with real-world knowledge ingestion challenges.
- Pace is achievable with the fitting abstractions
Constructing a production-grade NOC dashboard in hours—not days—is life like when the platform is designed for it.
Try the classes realized from the Occasion SOCs we deploy around the globe, with the white paper and newest blogs.
We’d love to listen to what you suppose! Ask a query and keep linked with Cisco Safety on social media.
Cisco Safety Social Media