Gerry Devenney

Splunk Administrator Architect @诺华

Working with Novartis personnel on various aspects of the Splunk distributed environment (approx. 75 servers in Production) including the following: • On-Boarding – Novartis initially developed QRadar as its SIEM using Syslog. In order to keep things stable, applications were on-boarded from syslog while UF were introduced. • Developing use cases – This was a standard for all applications which need to be amalgamated with rule migration from existing SIEM • Correlation search migration – All SIEM rules had to be assessed, defined, migrated to test environment. The test environment was then used to test and then copy the correlation search to the production environment. During my time at Novartis I was able to complete the following courses: Fundamentals 1 Fundamentals 2 Fundamentals 3 Splunk Data Administration Splunk System Administration Splunk Cloud Administration Splunk Cluster Administration Splunk Troubleshooting Advanced Dashboards and Visualizations with Splunk 7.3 Advanced Searching and reporting Architecting Splunk Enterprise Deployments Administering Splunk Enterprise Security 5.3 Using Splunk IT Service Intelligence 4.4 All of these courses were completed directly through Splunk using a Splunk account. All courses that were marked as IOD were passed. I am awaiting to do the “Splunk Deployment Practical Lab” in August. I am at present going through certification with Pearson-VUE.