Nobody Puts BloodHound in a Corner: Infusing APM into Your Identity Protection Strategy | SO-CON 26

[1-2 sentence BLUF with citation(s)]
A Cisco Distinguished Engineer explains how integrating Blood Hound Enterprise attack path data with Cisco Identity Intelligence and Splunk enhances incident response by correlating identity telemetry with security operations center workflows 0:00.

Key Takeaways:
• Cisco leverages its extensive identity history, including ISE, Duo, and Octa, to position itself as a leader in the Identity Visibility and Information Platform (IVIP) space 0:08.
• Effective identity security requires unifying data from multiple Identity Providers (IDPs) rather than relying on isolated logs, as no single provider sees the full user behavior picture 0:30.
• Integrating attack paths into the SIEM enables responders to build accurate timelines, identify pre-exploitation vectors, and understand the full blast radius beyond the initial compromise 0:42.
• Real-world remediation must address both legacy infrastructure issues and modern authentication flaws, requiring seamless collaboration between security operations and identity administration teams 1:05.

This session underscores the necessity of breaking down silos between identity management and security operations to achieve proactive, comprehensive threat visibility and faster remediation.

Sources:

• 0:00 Speaker introduction and partnership rationale
• 0:08 Cisco's history in identity management and IVIP positioning
• 0:30 The need to unify data across multiple IDPs
• 0:42 Benefits of integrating attack paths into the SIEM
• [1:05](