DOL - SECURITY INFORMATION AND EVENT MANAGEMENT (SIEM)

THIS IS AMENDMENT 0002 TO THE SOLICITATION. THIS AMENDMENT IS BEING ISSUED TO POST RESPOSES TO QUESTIONS. 1. QUESTION: HOW MANY SERVERS AND DEVICES ARE YOU LOOKING TO CAPTURE INFORMATION FROM? RESPONSE: TOTAL LOGS ACROSS ALL PLATFORMS HAVE BEEN SIZED TO AROUND 10,000 EPS. 2. QUESTION: WHAT ARE THE TYPES OF SERVICES AND DEVICES? RESPONSE: PLEASE SEE THE REQUIREMENTS WHICH OUTLINED ALL THE END-POINT TECHNOLOGIES. 3. QUESTION: HOW MANY USERS IN YOUR ENVIRONMENT? RESPONSE: TOTAL LOGS ACROSS ALL PLATFORMS HAVE BEEN SIZED TO AROUND 10,000 EPS WHICH ALSO INCLUDED USERS' SECURITY EVENTS. 4. QUESTION: ARE ALL YOUR SERVERS CENTRALLY LOCATED OR ARE THEY IN MANY DIFFERENT LOCATIONS? IF REMOTELY LOCATED, HOW MANY DIFFERENT LOCATIONS? RESPONSE: HW/LOG DISTRIBUTED. TOTAL LOGS ACROSS ALL PLATFORMS HAVE BEEN SIZED TO AROUND 10,000 EPS. 5. QUESTION: REQUIREMENTS 102 AND 104 REFER TO PROVIDING TERABYTES OF PHYSICAL SPACE. IS YOUR REQUIREMENT ASKING THE VENDOR WHO REPLIES TO INCLUDE STORAGE HARDWARE IN THEIR BID? RESPONSE: YES. IF YOUR SOLUTION DOES NOT PROVIDE REAL OR NEAR TIME STORAGE. 6. QUESTION: REQUIREMENT # 4 ASKS FOR APACHE SUPPORT. ARE YOU LOOKING FOR A SOLUTION THAT CAN CAPTURE, CORRELATE AND ALLOW FOR FORENSICS ON APACHE LOGS, OR ARE YOU LOOKING FOR A SOLUTION THAT ONLY USES APACHE AS A WEB INTERFACE? RESPONSE: LOG DATA SOURCE -APACHE HTTP SERVER LOGS 7. QUESTION CAN YOU PROVIDE MORE DETAIL AROUND REQUIREMENTS? A. 81 (SUPPORTS WIRELESS GEAR) IN WHAT CONTEXT? RESPONSE: LOG DATA COLLECTION FROM WIRELESS NETWORK GEARS B. 125 PROVIDES ROLLING BUFFER ACTIVATED BY AUTO-SENSING TECHNOLOGY? RESPONSE: IN TERMS OF HIGH SYSTEM AVAILABILITY, IT SENSES AND KNOWS WHEN IF THE DESTINATION IS DOWN/OFF-LINE AND WILL CACHE EVENTS AND THE ABILITY TO BUFFER THE LOGS. C. 105 PROVIDES THE ABILITY TO BLOCK ACCESS VIA NAC PRODUCT CONFIGURATION CHANGE? RESPONSE: APIS ABILITY TO INTEGRATE WITH NETWORK NAC BY FUNNELING EVENTS FROM SIEM (CHANGE OF STATE OR ATTACK) DIRECTLY INTO THE NAC POLICY SERVER (MCAFEE) BASED ON POLICY CHANGE. 8. QUESTION: REQUIREMENTS 63, 64, 123 AND 126 EITHER EXPLICITLY OR IMPLICITLY STATE THAT THE SOLUTION YOU ARE LOOKING FOR BE AN APPLIANCE AND WE ARE A SOFTWARE SOLUTION. ARE YOU REQUIRING THAT THE SOLUTION YOU GET BE AN APPLIANCE OR CAN THE SOLUTION TO MEET YOU REQUIREMENTS BE A SOFTWARE SOLUTION? RESPONSE: WE ARE LOOKING FOR AN APPLIANCE BASED SOLUTION 9. QUESTION WHAT ARE THE QUANTITIES OF MANAGED DEVICES (ROUTERS, SWITCHES, SERVERS, ETC.) TO BE QUOTED? RESPONSE: TOTAL LOGS ACROSS ALL PLATFORMS HAVE BEEN SIZED TO AROUND 10,000 EPS WHICH ALSO INCLUDED USERS' SECURITY EVENTS. 10. QUESTION: IS THE HA (HIGH AVAILABILITY) SITE IN THE SAME LOCATION? IF NOT, WHERE IS IT LOCATED? RESPONSE: HA IS NOT CURRENTLY IN THE SCOPE BUT THE TECHNOLOGY NEEDS TO HAVE THE CAPABILITY FOR FUTURE EXPANSION FOR SUCH CAPABILITY. 11. QUESTION: DO YOU WANT THE HA SITE TO CLONE THE PRIMARY SITE? RESPONSE: HA IS NOT CURRENTLY IN THE SCOPE BUT THE TECHNOLOGY NEEDS TO HAVE THE CAPABILITY FOR FUTURE EXPANSION FOR SUCH CAPABILITY. END OF AMENDMENT