Splunk Engineer-Core Certified Consultant/ ES Accreditation Required (R-00101)

Implement RBA : Develop and implement RBA strategies within Splunk ES to reduce alert noise and focus on high-fidelity alerts. Develop RBA components : Build and implement actionable alerts, workflow actions, risk incident rules, and risk scores. Create dashboards and reports: Design custom dashboards to visualize risk scores and provide context for analysts. Correlate data: Use Splunk's capabilities to correlate disparate events to identify patterns of risky behavior. Build custom solutions : Develop custom machine learning (ML) models to augment alerting and create automated workflows to improve efficiency. Content Development : Develop advanced security content, including dashboards, reports, and alerts, to highlight risk details, health analysis, and risk suppression specific to RBA environments. Data : Collaborate with application and system owners to onboard new data sources (e.g., from Windows, Linux, cloud services like AWS/Azure) and ensure proper parsing and enrichment for effective analysis within RBA. Correlate various data sources, such as logs from operating systems, applications, and cloud providers, into Splunk to feed RBA models.