--- title: "SharpHound Recon Attack – How AI enhanced the threat hunt" url: https://daily.dev/posts/sharphound-recon-attack-how-ai-enhanced-the-threat-hunt-cco5a280b source_url: https://blogs.cisco.com/security/clamer-soc-2026-sharphound type: article source: "Cisco" published: 2026-07-07T18:03:26.770Z updated: 2026-07-07T18:03:51.768Z tags: ["security", "authentication", "agentic-ai"] reading_time: 8 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SharpHound Recon Attack – How AI enhanced the threat hunt **[Cisco](https://daily.dev/sources/cisco)** · 8 min read · 0 upvotes · 0 comments ## Summary At Cisco Live Americas 2026, a SOC team investigated suspicious LDAP activity potentially indicating a SharpHound Active Directory reconnaissance attack. Using an Agentic SOC architecture that combined Cisco XDR, Splunk Enterprise Security, and Endace full packet capture via a Model Context Protocol (MCP) server, they built a Tier-2 AI analyst agent that autonomously pulled incident context, retrieved relevant packets, queried Splunk logs, and produced a structured threat assessment report. The agent concluded the activity was a benign near-miss, saving hours of manual analysis. Notably, the agent self-corrected a time-field error on its second pass and wrote the lesson back into its skill file. The post details the architecture, integration approach, and how AI-assisted analysis accelerated decision-making for analysts of all experience levels. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Cisco Live Amsterdam 2026: Using Agentic AI to shed light to SOC operations](https://daily.dev/posts/cisco-live-amsterdam-2026-using-agentic-ai-to-shed-light-to-soc-operations-dmhqynnog) · Cisco · 0 upvotes · 0 comments - [What Working the Cisco Live SOC Taught Me About AI, Detection, and Response](https://daily.dev/posts/what-working-the-cisco-live-soc-taught-me-about-ai-detection-and-response-ivw98ssq2) · Cisco · 0 upvotes · 0 comments - [Meet Instant Attack Verification: Agentic AI for Tier-1 and Tier-2 SOC investigation](https://daily.dev/posts/meet-instant-attack-verification-agentic-ai-for-tier-1-and-tier-2-soc-investigation-nfqqvludx) · Cisco · 1 upvotes · 0 comments - [Building the Agentic SOC at Cisco Live Americas 2026](https://daily.dev/posts/building-the-agentic-soc-at-cisco-live-americas-2026-gkkxnaj5g) · Cisco · 0 upvotes · 0 comments - [Cisco Ships Zero Trust for AI Agents, Self-Service Red Teaming, and Agentic SOC Tools at RSAC 2026](https://daily.dev/posts/cisco-ships-zero-trust-for-ai-agents-self-service-red-teaming-and-agentic-soc-tools-at-rsac-2026-3rtj4r1ea) · Security Boulevard · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#agentic-ai](https://daily.dev/tags/agentic-ai) [View this post on daily.dev](https://daily.dev/posts/sharphound-recon-attack-how-ai-enhanced-the-threat-hunt-cco5a280b)