• Reviewing alarms and alerts
• Confirming, determining, or adjusting the criticality of alerts
• Identifying other high-risk events and potential incidents
• Escalation to Tier 2
• Basic configuration of monitoring tools
• MTTD (Mean Time to Detect): time to identify potential threats
• Alert volume handled: number of alerts reviewed per shift
• Escalation rate: percentage of cases requiring Tier 2 involvement
• False-positive reduction rate
• Documentation quality: completeness of case records
• Training frequency: number of upskilling sessions per year

Requirements

• Ability to write and optimize queries, create dashboards, reports, and alerts, and perform data analysis within the Splunk platform
• General understanding of Splunk architecture and components
• Knowledge of log collection methods, both agent-based and agentless (e.g., Syslog, API integrations)
• Familiarity with various log formats
• Understanding of network-based attacks
• Understanding of endpoint-based attacks