Hello there.
As the days get shorter and the autumn chill sets in, it is a good reminder that identity and cloud security work best when nothing’s left in the dark so this November’s Casseopeia Edition, we are shining a light on the trends and tools that help ensure your product is better integrated and ready to work seamlessly across the modern security stack. As cloud adoption grows, identity has become the new security perimeter. It now stands as both a critical risk vector and a core component in third-party security integrations across platforms. CyberArk, which is in the process of being acquired by Palo Alto Networks, announced the upcoming general availability of its Secure AI Agents Solution, extending its identity-security platform to cover a new class of identities: autonomous AI agents. This marks a shift where identity security now includes AI agents, not just humans, machines, or service accounts. It expands the traditional IAM/PAM model and forces vendors and customers to rethink identity boundaries. This means integrating AI-agent identity into governance, least privilege, lifecycle, auditing which may introduce new tools and workflows. With identity and cloud/security stacks rapidly converging, Google Cloud has announced the “Google Unified Security Recommended” (GUSR) program. This program recognizes vendors whose solutions are deeply validated and integrated across Google’s security ecosystem. The program ties identity telemetry/integration into cloud security partner ecosystems since identity is now central to cloud security posture, not a standalone silo. CrowdStrike’s Falcon platform for instance integrates with Google’s identity, and telemetry systems to deliver unified protection. As a trusted Google Cloud and Security Operations partner, Metron Security is at the forefront of building modern, scalable integrations that align with Google’s evolving security architecture.
In addition, over the last few months, we have seen that several big vendors are converging on the same direction: CrowdStrike (Sept): Announced Falcon Next-Gen Identity Security, unifying protection for all human, machine, and AI identities. Microsoft (Sept): Rolled out new AI-driven identity security features, including Security Copilot for Entra and the Conditional Access Optimization Agent. Okta Identity Governance (Nov): Release added Security Access Reviews (now GA in preview environments) and event-triggered access reviews with APIs to launch and manage them programmatically. Okta is moving toward an identity-centric posture management layer that covers users, machines, and SaaS identities. At AWS re:Inforce2025 : AWS highlighted several new IAM features such as IAM Access Analyzer’s new “Internal Access Findings,” which shows who inside your organization can access specific critical resources.
These trends make identity the central control point for cloud and AI security, requiring tighter, real-time interoperability across platforms. As a result, integrations and workflows will shift toward continuous automation that spans apps, clouds, and AI systems. |
|
| |
New Release: IAM Integration Guide
We recently published a comprehensive technical guide on integrating with leading IAM platforms, including Microsoft Entra ID, Okta, CyberArk, and AWS IAM. The guide breaks down the full integration lifecycle, covering technical architecture, implementation strategies, and deployment patterns for third-party security integrations. It explores the critical considerations teams often overlook: API rate limits, SCIM implementation differences, multi-tenant orchestration models, and event-driven architecture design. We also walk through common integration challenges and how to avoid them, ensuring your solution functions reliably in production. From selecting authentication protocols and designing API access patterns to testing, validation, and marketplace publication—we cover every step required to build secure, resilient, and future-ready IAM integrations. |
|
| |
Under the Lens — Cisco & Splunk Security Product Landscape
Cisco’s security (including Splunk) hit $8.09B in FY2025, growing 59% YoY giving it one of the largest and most influential security footprints in the enterprise market. For technical product leaders, this means Cisco often defines the default operational patterns for network, identity, and threat workflows. Hence, integrating with Cisco ensures architectural fit and accelerates adoption in Cisco-standardized environments. Let’s explore the key domains within Cisco’s comprehensive cybersecurity portfolio: Network Security Cisco Firewalls (Secure Firewall Threat Defense & ASA): Deliver advanced threat prevention, application visibility, IPS, and encrypted traffic analytics across data center, campus, and multi-cloud environments.
Cisco Security Cloud Control: Centralizes policy management, analytics, and orchestration across the entire Cisco security portfolio—simplifying enforcement, compliance, and cross-domain configuration.
Cisco Identity Services Engine (ISE): Enforces adaptive, identity- and context-aware network access controls using device profiling, posture assessment, and dynamic segmentation.
Cisco XDR: Correlates telemetry from endpoints, email, network, and cloud sensors to detect multi-vector attacks and accelerate triage and response.
Splunk Enterprise Security: Provides real-time SIEM analytics, correlation searches, dashboards, and adaptive response actions to detect threats across hybrid environments.
Cloud Security Cisco AI Defense uses generative AI and machine learning to detect advanced threats, automate investigations, evaluate false positives, and optimize response workflows.
Cisco Attack Surface Management (ASM) continuously discovers external assets, exposures, and misconfigurations—prioritizing risks based on business impact and exploitability.
Cisco Umbrella combines DNS-layer security, secure web gateway (SWG), CASB, and firewall services to block malicious destinations and secure SaaS access from any device/location.
Splunk Attack Analyzer (formerly TwinWave) performs dynamic malware analysis and automated detonation of suspicious files/URLs to accelerate cloud SOC decision-making.
Splunk Cloud Platform delivers scalable, cloud-native SIEM/log analytics for ingesting, correlating, and retaining security-relevant data across multi-cloud environments.
Industrial Security Cisco Industrial Threat Defense provides real-time threat detection, segmentation, and monitoring of industrial protocols (Modbus, DNP3, CIP, etc.) across OT networks.
Cisco Cyber Vision gives deep visibility into OT/ICS assets, network flows, and risk posture—detecting anomalies and unauthorized changes in operational environments.
Splunk OT Security Offers unified monitoring of OT and IT telemetry, identifying anomalies in industrial systems and correlating them with enterprise security events.
Application Security Cisco Hypershield’s distributed, microsegmented runtime defense is embedded directly within the application fabric, providing autonomous, AI-driven protection against exploits and lateral movement.
Cisco Secure Workload (Tetration) implements zero-trust microsegmentation, workload dependency mapping, and runtime policy enforcement across VMs, containers, and bare-metal servers.
Cisco Web Application & API Protection (WAAP) protects web apps and APIs from DDoS, injection, bot abuse, and zero-day exploits using behavioral analytics and continuous traffic inspection.
Splunk Observability Cloud provides full-stack application monitoring, tracing, and metrics—with anomaly detection that feeds into security and performance analysis.
Splunk Vulnerability Risk Management (VRM) aggregates vulnerability data across workloads, applications, and containers, prioritizing remediation based on exploitability and business impact.
User Security Cisco Secure Email Threat Defense uses advanced AI, behavioral analysis, and threat intelligence to detect phishing, BEC, malware, spoofing, and credential-harvesting campaigns.
Cisco Secure Service Edge (SSE) unifies Zero Trust Network Access (ZTNA), secure web gateway, and CASB capabilities, providing identity-aware access to cloud applications.
Cisco Secure Web Appliance (formerly WSA) provides on-premises and hybrid web filtering, malware scanning, TLS inspection, and DLP to secure user browsing.
Splunk User Behavior Analytics (UBA) applies machine learning to identify insider threats, compromised users, privilege abuse, and anomalous authentication patterns.
To integrate effectively with the Cisco and Splunk ecosystems, the most optimal approach is to start with a shared security data model and identity-driven workflow integration ensuring your product can natively exchange telemetry, policy signals, and enriched context with both platforms. As a Cisco / Splunk technical partner, Metron is well positioned to help you navigate and support your integration roadmap. 
Optimizing Cisco Platform Usage
To improve protection and operational efficiency with Cisco’s security portfolio, organizations can adopt a layered, architecture-driven deployment strategy: Establish a network defense foundation: Deploy Cisco Firewalls and Security Cloud Control for centralized, cross-domain policy enforcement; integrate Cisco ISE to drive adaptive access control through identity, device posture, and segmentation data; and enable Cisco XDR to correlate telemetry across endpoints, email, network, and cloud sensors for unified detection and automated response workflows. Extend cloud and application protection: Configure Cisco Multicloud Defense and Cisco Umbrella for multicloud traffic visibility, DNS-layer protection, and CASB/SWG-driven access controls; deploy Cisco Hypershield for distributed runtime protection embedded at the workload layer; and use Cisco Secure Workload alongside Cisco WAAP to enforce microsegmentation and API/web-application defenses against lateral movement and exploit attempts. Strengthen industrial resilience: Implement Cisco Cyber Vision and Industrial Threat Defense to automatically discover OT assets, map industrial protocol flows, enforce segmentation policies, and detect anomalies without interrupting production systems.
Cisco’s platform-centric design, built on shared identity, telemetry, and policy layers like ISE pxGrid, XDR data enrichment, and Security Cloud Control, makes it easier for tools to integrate and work together across network, cloud, application, and OT environments. This shifts security operations from reacting to problems to continuously protecting systems with clear, real-time context. |
|
| |
Security Application and Version Updates Palo Alto Networks Launches AIRS 2. Key highlights of this release include: Real-time defense for autonomous agents, including discovery and monitoring of unsanctioned (“shadow”) AI agents. Continuous, autonomous red-teaming against generative AI applications with multiple simulated attack techniques to identify vulnerabilities before they are exploited. Deep model analysis to detect AI-specific threats such as backdoors, data poisoning, and hidden malicious layers, providing governance, visibility, and control over model assets.
CrowdStrike Introduces Charlotte Agentic SOAR. Key highlights of this release include: AI Agents – Purpose built agents that can automate SOC tasks including malware analysis, exposure prioritization, and correlation rule building. Agent Builder (AgentWorks) – No-code platform for creating custom AI agents using natural language to define objectives, data sources, and actions. Agent Orchestration – Visual workflow builder that coordinates agents and integrates tools through hundreds of pre-built connectors. It also supports both static and adaptive workflows. Unified Case Management – Centralized workspace within Falcon Next-Gen SIEM for tracking investigations, metrics, and team collaboration.
Google SecOps Introduces Alert Triage and Investigation Agent in Public Preview. Key highlights of this release include: Autonomous Alert Investigation – The agent performs initial triage by autonomously gathering evidence, running analyses, and delivering verdicts, reducing the workload for analysts. Mandiant-Based Analysis – Analyzes alerts using Mandiant principles and industry best practices, evaluating incoming alerts, executing investigation plans, and providing structured analysis. Investigation Capabilities – Runs dynamic searches to collect additional context, enriches indicators of compromise with Google Threat Intelligence data, analyzes command lines in natural language, and reconstructs process trees. Transparent Reporting – Provides comprehensive investigations with full explainability, clarifying its process and referencing sources when making recommendations. Each investigation includes disposition, confidence level, and supporting evidence.
|
|
| |
Insights: From Our Integration Factory 
Google SecOps + DRP: Integrates external threat intelligence into Google’s security operations to detect and respond to credential leaks, phishing domains, and brand impersonation in real time. Core Functions: Discovers exposed credentials and cloned infrastructure, correlates findings with internal telemetry, and enriches alerts with IOC provenance and risk context for prioritized response. Trigger and Flow: When new external indicators are identified, intelligence is ingested via secure APIs into Google SecOps, where correlation engines match observables and trigger automated workflows such as credential revocation or domain takedown. Authentication and Security: Integration uses least-privilege Google Cloud IAM roles, short-lived tokens, and mutual TLS for secure data exchange and source verification. Impact: Creates unified visibility across external and internal threat surfaces, improving detection accuracy and accelerating automated containment of exposure-driven attacks.
Microsoft Defender for Endpoint + XDR: Combines endpoint telemetry with extended detection and response analytics to deliver better visibility and adaptive threat detection across devices, identities, and workloads. Core Functions: Collects behavioral signals from endpoints, correlates them with cross-domain telemetry such as identity, network, and cloud data, and applies machine learning models for anomaly detection, lateral movement tracking, and automated threat scoring. Trigger and Flow: When malicious activity is detected at the endpoint level, telemetry is streamed to the XDR layer, where correlated analytics identify multi-stage attack chains. The system then initiates automated containment actions like isolating devices, suspending user tokens, or revoking access policies. Authentication and Security: Uses Azure Active Directory conditional access and token-based authentication with granular RBAC for analyst and API interactions. Data is transmitted through encrypted channels with event signing to ensure integrity. Impact: Provides end-to-end threat visibility and automated response orchestration across the enterprise. Reduces dwell time through cross-domain correlation and more precise containment by unifying endpoint defense with extended detection intelligence.
ServiceNow ITSM + BAS: Integrates continuous attack simulation with IT service workflows to validate security controls, automate remediation, and align operational response with real-world threat scenarios. Core Functions: Runs controlled attack simulations across endpoints, networks, and applications, maps result to MITRE ATT&CK techniques and generates prioritized remediation tickets directly in ServiceNow ITSM. Trigger and Flow: When a simulation detects a failed control or exposure, the BAS platform automatically creates an incident or change request in ServiceNow ITSM, assigning tasks to the responsible team. Workflow automation ensures verification upon remediation completion, maintaining a continuous improvement cycle. Authentication and Security: Integrations leverage secure REST APIs with OAuth 2.0 and scoped service accounts. All event data and remediation evidence are transmitted over encrypted channels and logged for audit compliance. Impact: Bridges the gap between offensive validation and operational response, ensuring vulnerabilities are not only detected but systematically remediated. Also provides measurable security posture improvement by embedding BAS findings directly into ITSM-driven operational workflows.
|
|
| | |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
