The NOC Report
summary
Black Hat NOC runs an enterprise network in two days using Palo Alto 5280s, Arista 7280 tap aggregation, NetWitness packet decoding and Umbrella DNS; it records 73,800 severe threats detected over four days with only 131 blocked, about 4 TB packet capture kept live for on-site analysis then wiped. Expectations break: ~1,500 unique devices, TikTok in top apps, three VPNs leak data (one leaking lat/long), an attendee launches mass SQLi/WordPress/payment scans, nine rogue AP attempts, and automated captive‑portal remediation catches C2 or crypto mining.
AI-written summary · about
chapters (14)
- 0:00Introduction to the team
- 1:38NOC partners and selection
- 3:23Network architecture and reality
- 5:21Visualization and dashboards
- 7:23Traffic and threat statistics
- 9:21Traffic trends and usage
- 11:35Encryption and packet capture
- 12:53App usage and VPN security
- 15:26Evolution and security goals
- 19:23Modern SOC capabilities
- 22:05Security findings and stories
- 27:03VPN leaks and network risks
- 29:31Incident response examples
- 34:39Q&A and concluding remarks
related talks
38mThe Black Hat Europe Network Operations Center (NOC) Report
54mLessons and Lulz: The 5th Annual Black Hat USA NOC Report
40mThe 9th Annual Black Hat USA Network Operations Center (NOC) Report
47mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
33mThe Black Hat Europe NOC Report
45mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
47mTales from the NOC: Going Public in Asia
45mThe Black Hat NOC: Greatest Hits and Holy...Cows