Enterprise Logging Xtreme -Software

Notice of Contract Action (NOCA) for Enterprise Logging Xtreme (ELX) *NOTE CHANGE EFFECTIVE 27 APRIL 2022 : This NOCA is only for ELX software, and the ELX hardware is projected to be a competitive effort. 1. The Government intends to award a sole source contract to Enlighten IT Consulting, LLC under the statutory authority, FAR 6.302-1 Only one responsible source and no other supplies or services will satisfy agency requirements. 6.302-1(a)(2) When the supplies or services required by the agency are available from only one responsible source, or, for DoD, NASA, and the Coast Guard, from only one or a limited number of responsible sources, and no other type of supplies or services will satisfy agency requirements, full and open competition need not be provided for. *NOTE CHANGE EFFECTIVE 2 MAY 2022: Removing Authority FAR Subpart 6.302-1(a)(2)(i)(A) demonstrates a unique and innovative concept, as this was included in error. This should have only been included if it was IAW 6.302-1(a)(2)(i) Supplies or services may be considered to be available from only one source if the source has submitted an unsolicited research proposal. This was in response to an RFI, and the Government did not receive any unsolicted research proposals. 2. Description of supplies/services that meet agency needs: ELX components consists of LTAC software, fielding to 196 Air Force bases, deployment, sustainment, authorization to operate (ATO), testing, and training on unclassified and secret domains. Development and integration will also be built into the contract to provide flexibility throughout the period of performance. The software which is made of up of Government Off-the-Shelf (GOTS), Lower Echelon Analytic Platform (LEAP) Tactical (LTAC) configuration, demonstrates a unique and innovative concept. As adversary capabilities have increased and the threat to DoD networks has grown in maturity, the AF needs to be more effective in monitoring its geographically dispersed capabilities. For several years, the operational community has highlighted the need to aggregate network logs in a centralized location. Collecting and storing network logs from every Air Force base to make them available for long term analysis, correlation, and visualization, will enable AF Cyber warfighters to be more effective by giving them visibility into real time network activity, as well as the historic network events that give context to the real time activity. Instead of deleting old logs, we'll have the ability to correlate them with older contextual network and system information to paint a full picture of adversary activity, enable true hunting and detection of advanced persistent threats to the network. The LTAC software for the ELX effort is designed to meet this logging need by facilitating the collection and aggregation of logs from across 196 AF bases to a centralized location in the cloud. LTAC will collect, store, and analyze all data from each AF base as well as forward prioritized data sets to the cloud to be ingested into the Enterprise Logging Ingest and Cyber Situational Refinery (ELICSAR) Big Data Platform (BDP), and leveraged by the Security Information Event Management (SIEM), Security Orchestration Automation, Response (SOAR), and other Cyber Security and Defense (CS&D) capabilities to facilitate cyber defense and netops. Additionally, analytical capability will be deployed to each base to be used on the real time data and provide the ability to connect back to ELICSAR and across bases for distributed querying and information sharing. This architecture will provide the Air Force with the data fabric to facilitate enterprise cyber situational awareness to enable defensive cyber operations at scale. The analytics will executed by LTAC, a lightweight version of the ELICSAR BDP that can run on a single node, allowing forward deployed analytical capability with familiar interface of the enterprise ELICSAR system. The LTAC software solution has several key functions that support of the ELX effort: -Implementing LTAC as a store-and-forward capability allows for the collection and analytics of network logs throughout the distributed AF locations. -DevSecOps for platform engineering, optimization, maintenance, monitoring, and lifecycle management over time. -Sustainment of software licenses as specified by the government in support of the deployment waves. -Data engineering services for subscribing to internal data source in a high availability manner. -Software support in the form of development teams working in an agile manner directed by the ELX PMO, working features prioritized in each program increment planning session. -Documentation support that consists of development of ELX for the operational force. -Training support to ensure proper employment of ELX for operational force. -Authorization and accreditation support to accomplish and maintain ATO on unclassified and secret domains. 3) The government intends to award a sole source contract for up to three (3) years with a six (6) month extension of service to Enlighten IT Consulting, LLC. This will give contractors awareness and time to learn the LTAC software and the Big Data Platform (BDP) within the first year to potentially become competitive in years two (2) and three (3). Through additional market research if there are proven capabilities and competition, the government will compete the effort for years two (2) and three (3). If there is no competition at the end of the first year, the government will continue with exercising options in years two (2) and three (3). After the third year, the government will continue to monitor market information for any changes or improvements of the software. This information will be used to determine whether other available competitive sources for the same or similar products can meet the program needs.