وسيم منصور

● Analyze and correlate logs to identify security incidents.
● Investigate deep on incidents escalated from L1, L2 to identify real time threats and attacks.
● Create and manage Correlation Searches, Notifications, Jobs.
● Fine tune correlation searches as per the requirement.
● Creating Daily, Monthly reports and Ad-hoc reports of various devices as per the requirement.
● Extract unparsed data from custom log files using Regular Expressions.
● Perform regular health check and ensure efficient operation of Splunk.
● Performs installation, upgradation of Arcsight components like Connectors, Loggers, ESM.
● Creating and finetuning Rules, Dashboard, Filters, Reports, Queries etc. in ArcSight.
● Device integration to Arcsight including Flex connector development.
● Creating Daily, Monthly reports and Ad-hoc reports of various devices as per the requirement.
● Expertise to analyze and correlate alerts raised by L1 Team