2026.08.06_Sole-Source Determination and Justification Template_SIEM_abl.pdf

Sole-Source Determination_rev01-31-24 Page 1 of 4

SOLE-SOURCE DETERMINATION AND JUSTIFICATION FOR

SUPPLIES AND SERVICES

Date: August 6th, 2026 To: April Brenden-Locke, Designated Procurement Officer, Contract Services, Administrative Services Division

From: Caleb Naughton Deanna Erickson Luca Wittenberg

RE: Sole Source Determination pursuant to Oregon Revised Statute (ORS) 279B.075 and

Oregon Administrative Rule (OAR) 125-247-0275

CSR: #073-26, Security Information & Event Management (SIEM) Solution

1. Authority to enter into a Sole-Source Contract: OAR 125-246-0170(2)(c)(H)

2. Estimated Total Value of the Procurement: $ 106,442.57 (three-year total cost)

$ 82,093.60 (one-year total cost)

3. Background:

ODFW is preparing to procure a Security Information & Event Management (SIEM) solution as an interim measure while long‑term planning continues regarding eventual migration of ODFW systems to the State Data Center (SDC). Historically, DAS Enterprise Information Services (EIS) encouraged ODFW to leverage the SIEM capabilities available through SDC. Through technical discussions, however, ODFW determined that the SDC-provided SIEM cannot meet ODFW’s operational needs because it does not provide direct visibility into ODFW’s log data beyond agency PC’s. This limitation created a functional gap that SDC acknowledged, and an exception was granted to allow ODFW to use ManageEngine Log360 SIEM. Prior to submitting the IT Investment (ITI) Form dated March 2nd, 2026, ODFW evaluated its SIEM requirements (including on‑premise deployment, predictable cost structure, Active Directory auditing, sufficient log ingestion capacity, and operational similarity to SDC’s internal tools) and determined that ManageEngine Log360 was the most appropriate solution to fill the interim gap. In this review, ODFW considered its past experience with Splunk, which had proven to be cost‑prohibitive and technically challenging, resulting in only limited functionality being deployed across the agency. In contrast, Log360 is technically simpler, aligns with agency needs, requires no specialized training, and provides the operational visibility that the SDC-provided SIEM currently cannot offer. A demonstration of Log360 further confirmed that it met all identified requirements.

These considerations were documented in the updated ITI, which stated that “ODFW’s preference is to use Vendor / Product ManageEngine Log360.” DAS subsequently acknowledged that ODFW “was wanting to purchase ManageEngine” and confirmed there were “no issues with the agency moving

Sole-Source Determination_rev01-31-24 Page 2 of 4 forward,” validating ManageEngine as an acceptable interim solution during the period before future SDC migration decisions are finalized.

High-level requirements for ODFW’s interim SIEM solution include (but are not limited to):

- Self‑hosted / on‑premise deployment with documented sizing and infrastructure requirements for production.

- Collection and analysis of Active Directory domain controller logs, including directory‑related audit events.

- Ingestion from network security devices, including firewalls and next‑generation firewalls.

- Ingestion from Windows servers and endpoints / workstations.

- Configurable correlation rules for event analysis.

- Real‑time alerting based on defined detections or conditions.

- Retention of computer system security records for at least 3 years.

- Role‑based access control (RBAC) for administrative access.

Based on this governance guidance, ODFW seeks to procure ManageEngine Log360 as a temporary SIEM that satisfies ODFW’s on‑premise deployment requirement, provides required visibility into agency log data, aligns with SDC‑compatible operational practices, and supports ODFW’s information security needs while longer‑term enterprise solutions are explored.

4. Findings:

A. Market Research Overall Finding.

ODFW conducted market research through analysis of SIEM marketplace trends, internal product reviews, and consultation with DAS EIS regarding acceptable interim solutions. Recent market analyses and vendor documentation confirm that the majority of modern enterprise SIEM platforms are cloud‑native or cloud‑hosted (including Microsoft Sentinel, Splunk Cloud Platform, Palo Alto Networks Cortex XSIAM, and Securonix).

Independent industry analyses confirm the SIEM market’s shift toward cloud‑native and cloud‑hosted architectures, with modern SIEMs increasingly characterized by cloud‑scale, AI‑assisted deployments and a fast‑growing cloud‑native SIEM segment. (Palomarr, 2026) (Global Cloud Native SIEM Industry Trends Analysis Report 2025, Forecast to 2033 (Broken Down by Type, End User, Regional Analysis, and Competitive Landscape), 2026)

ODFW requires an on‑premise solution because of a) data‑classification considerations and b) the need for direct operational visibility into ODFW’s own logs make a self‑hosted approach necessary; these constraints limit the available market to vendors with on‑prem deployment.

Within that narrowed set, ManageEngine Log360 provides documented on‑prem deployment, agent / collector models, and HA / DR options aligned to ODFW’s operational requirements for an interim, self‑hosted SIEM.

Market research therefore identified ManageEngine Log360 as uniquely capable of meeting ODFW’s operational requirements, including on‑premise deployment, cost stability through source‑based licensing, sufficient ingestion capacity, AD auditing and network monitoring aligned to SDC practices, and suitability as a transitional solution prior to any SDC migration.

https://learn.microsoft.com/en-us/azure/sentinel/overview?tabs=defender-portal https://www.splunk.com/en_us/products/splunk-cloud-platform.html https://www.paloaltonetworks.com/cyberpedia/what-is-extended-security-intelligence-and-automation-management-xsiam https://www.paloaltonetworks.com/cyberpedia/what-is-extended-security-intelligence-and-automation-management-xsiam https://www.securonix.com/

Sole-Source Determination_rev01-31-24 Page 3 of 4

And

B. Findings of Fact pursuant to OAR 125-247-0275(2) must include, at a minimum, one of the following:

1. Pursuant to OAR 125-247-0275(2)(a): Compatibility. Provide findings supporting your determination that the efficient utilization of existing goods requires the acquisition of compatible goods or services from only one source.

2. Pursuant to ORS 279B.075 (2)(b): Exchange of Software or Data. Provide findings supporting your determination that the goods or services required for the exchange of software or data with other public or private agencies are available from only one source.

3. Pursuant to ORS 279B.075 (2)(c): Pilot or Experimental Project. Provide findings supporting your determination that the goods or services are for use in a pilot or an experimental project.

4. Pursuant to ORS 279B.075 (2)(d): Other findings that support the conclusion that Supplies and Services are available from only one source may include but are not limited to considerations of: unique design, availability, geographic location, exclusive authorized representative, cost of conversion, and warranty services.

ODFW requires an on‑premise SIEM solution to maintain direct visibility into agency log data, satisfy security and data‑classification considerations, and support operational continuity until a future SDC migration occurs. SIEM solutions commonly available through statewide enterprise price agreements are cloud‑hosted, do not provide the necessary level of operational control, or rely on ingestion‑metered licensing that is incompatible with ODFW’s environment.

During governance review of the ITI dated March 2nd, 2026, DAS EIS acknowledged ODFW’s intent to procure ManageEngine Log360, noted that the proposed solution aligned with ODFW’s interim SIEM needs, and confirmed that ODFW could move forward with procurement. This governance validation established that ManageEngine met ODFW’s required conditions for pre‑migration SIEM functionality.

ManageEngine is uniquely positioned to meet ODFW’s needs because it:

- Provides on‑premise deployment

- Provides sufficient log ingestion capacity for ODFW’s environment

- Offers source‑based licensing, mitigating ingestion‑based cost volatility

- Incorporates AD auditing and network monitoring capabilities similar to those used in the State Data Center

- Provides operational workflows compatible with SDC’s SIEM practices, supporting future migration

- Avoids significant cost of conversion associated with alternatives that differ substantially in architecture, licensing, or operational design

Because no other available SIEM meets ODFW’s mandatory on‑premise deployment model, cost‑predictability needs, visibility requirements, and alignment with DAS governance direction, ManageEngine Log360 is the sole source capable of providing the required interim SIEM services under ORS 279B.075(2)(d).

Sole-Source Determination_rev01-31-24 Page 4 of 4

Part B - Conditions of Approval will be inserted by ODFW-DPO.

April Brenden-Locke, Contract Services Manager, ODFW Date

Bibliography

(2026). Global Cloud Native SIEM Industry Trends Analysis Report 2025, Forecast to 2033 (Broken Down by Type, End User, Regional Analysis, and Competitive Landscape). Maia research.

Palomarr. (2026, January 7th). SIEM market map and supplier insights Q1 2026. Retrieved from https://www.palomarr.com/cs/siem/insights/q1-2026/

8/6/26

Bibliography