Network-Centric Detection and Response Platform

The Vendor is required to provide to consolidate and integrate its security platforms from the current disparate (or absent) technologies into a single, unified cloud native, or hybrid platform that can take all the relevant data from identities, endpoints, network switches, iot devices, firewalls and servers to create near real time cybersecurity alerts with holistic context for cybersecurity staff.
- The platform should use artificial intelligence to correlate and analyze incidents and define, prioritize and automate standard incident response activities in a digital workflow.
- The solution is expected to seamlessly integrate its security operations, monitoring and alerting across and between identities, endpoints, iot and network infrastructure so that using artificial intelligence (AI), anomalous events are correlated and presented as security incidents with available automated actions taken, reviewed and refined by human cybersecurity and it administrators.
- The solution can be cloud-native (with the ability to generate local logs as required) and should be accessible and functional from any browser on any operating system and on any device.
- Proponents must provide a proposed pilot implementation approach, including:
• Pilot objectives
• Success criteria and measurable performance metrics
• Pilot scope and duration
• Resource and support requirements
• Reporting and evaluation methodology
- Plan must include all major activities and milestones associated with the implementation and operationalization of the proposed network detection and response (NDR), supporting endpoint detection and response (EDR), and DNS threat intelligence and security capabilities.
- This includes, but is not limited to:
• Architecture validation and deployment design
• DNS telemetry integration and domain name system (DNS) threat intelligence configuration
• NDR sensor deployment and telemetry onboarding
• Flow telemetry integration
• Supporting EDR deployment and integration activities
• Google workspace for education and identity-related integrations
• Detection tuning and alert optimization
• Testing and validation activities, including simulated threat scenarios
• Training, operational readiness, and knowledge transfer
• Production go-live and transition to operational support.