RFI AMD02 CTI Aggregation_832469849.docx

RFI# 832469849

REQUEST FOR INFORMATION

AMENDMENT 02

Joint Force Headquarters-Department of Defense Information Network (JFHQ-DODIN)/J4 is seeking information from industry to assist with the development and planning of a potential new requirement.

THIS IS A REQUEST FOR INFORMATION (RFI) NOTICE ONLY. THIS IS NOT A REQUEST FOR PROPOSALS (RFP). NO SOLICITATION IS AVAILABLE AT THIS TIME.

1. Overview/Purpose/ Description of Procurement:

The primary role of joint intelligence is to provide information and assessments to facilitate mission accomplishment. This role is supported by a series of specific responsibilities to guide the intelligence directorate of JFHQ-DODIN and supporting organizations. These include the following: Inform the commander, describe the operational environment (OE); identify, define, and nominate objectives; support planning and execution of operations; counter adversary deception and surprise; support friendly deception efforts; and assess the effectiveness of operations.

The JFHQ-DODIN Capability Development Directorate is seeking information from industry to assist with the development and planning of a potential new requirement.

JFHQ-DODIN is seeking information from industry regarding Cyber Threat Intelligence (CTI) Aggregation enterprise (cloud-based) capability that can ingest multiple third-party CTI feeds and external threat data. JFHQ-DODIN reviews and analyzes classified and open-source threat intelligence to identify attack indicators, mitigate identified threats, establish threat data feeds, and share advisories with DODIN customers and other federal specialists.

A critical mission of JFHQ-DODIN is to conduct defensive cyber operations (DCO) consisting of passive activities intended to preserve the ability to utilize DoD cyberspace capabilities and to protect DoD data, networks, and systems. As cyber threats proliferate – both in terms of numbers and sophistication – the ability of JFHQ-DODIN to successfully perform the CTI role in defensive cyber operations becomes more and more challenging. We are interested in identifying a commercial solution capable of aggregating and correlating cyber threat intelligence information. We are interested in solutions that provide Artificial Intelligence (AI) to help our analysts identify common patterns of information across multiple sources of information.

The analyst requires an ability to ingest the current CTI Feeds into a single solution, to correlate and validate each Indicators of Compromise (IOC) as they are being processed in automated fashion. The capability shall include ingest from both existing Data/Application Programming Interfaces (APIs) as well as multiple cyber intel feeds that will be aggregated and analyzed in single interface. In addition, the capability shall provide the ability to manually upload data from spreadsheets and documents; ingest from existing DoD cyber repositories, have the processing power to ingest multiple feeds at the same time, and be powered by AI and Machine Learning (ML) for the purposes of conducting queries, analysis, and alerting.

2. Scope of Effort:

JFHQ-DODIN requires a cloud-based (off-premises) capability to ingest most CTI sources, as well as some non-standard sources such as spreadsheets, PDFs, unstructured blogs, and news articles, that enables their ability to aggregate the feeds to centralize the sources for more efficient processing. This capability should provide the resources to create a semi-automated process for providing context to the Indicators of Compromises and rapidly assess duplication and information validity confidence levels. This app-agnostic capability needs to leverage Artificial Intelligence techniques to pull data at scale from different APIs, as well as the non-standard sources, aggregate and normalize the data, and identify base-line anomalies for the analyst to prioritize investigating.

3. Technical Characteristics:

JFHQ-DODIN desires a complete CTI Aggregator Software as Serve (SAAS) cloud-based (off- premises) solution.

· The capability shall have the ability to develop displays customizable to user's preference.

· The capability shall have the ability to display threat level via Machine Learning.

· The capability shall have the ability to prioritize vulnerabilities via Machine Learning.

· The capability shall have the ability to collate known incidents and alerts via analyst's query.

· The capability shall have the ability to accept various data formats.

· The capability shall have the ability to display known threats and status.

· The capability shall have the ability to provide Predicative analysis based on MITRE ATT&K framework.

· The capability shall have the ability to provide early warning detection of vulnerability exploitation.

· The capability shall have the ability to manually add normal and abnormal ranges for anomaly detection.

· The capability shall have the ability to remove unstructured/redundant data.

· The capability shall have the ability to create a standardized data format.

· The capability shall have the ability to ingest multiple cyber intel feeds based on analyst's preference.

· The capability shall have the ability to manually upload spreadsheet and documents.

· The capability shall have the ability to add information from documents into intel aggregation.

· The capability shall have the ability to ingest multiple feeds simultaneously.

· The capability shall have the ability to correlate multiple feeds for predicative analysis.

4. Requested Information:

· What capabilities are applicable to ingest data from existing APIs and multiple cyber intelligence feeds?

· Are capabilities available to ingest data from multiple feeds at the same time?

· How would you ingest data from existing Big Data Platforms?

· How would you use Machine Learning to prioritize vulnerabilities?

· How useful is machine learning to display threat levels?

· How would you manually add normal and abnormal ranges for anomaly detection?

· What capabilities are available to correlate multiple feeds for predicative analysis?

· How would you apply Artificial Intelligence (AI) and machine learning to predicative analysis?

· What capabilities are available to remove unstructured/redundant data?

· How would you create a standardized data format?

· What capabilities/tools are available to develop customizable displays based on user preferences?

· How applicable is AI for the purposes of conducting queries, analysis, and alerting?

RESPONSE GUIDELINES:

Interested parties are requested to respond to this RFI with a white paper. Submissions cannot exceed 8 pages, single spaced, 12-point type with at least one-inch margins on 8 1/2” X 11” page size. The response should not exceed a 5 MB e-mail limit for all items associated with the RFI response. Responses must specifically describe the contractor’s capability to meet the requirements outlined in this RFI. Oral communications are not permissible. SAM.gov will be the sole repository for all information related to this RFI.

Companies who wish to respond to this RFI should send responses via email no later than (NLT) 9 August 2024, 11:59 PM (CT) to carrie.e.bair.civ@mail.mil.

INDUSTRY DISCUSSIONS:

DISA representatives may choose to meet with potential offerors and hold one-on-one discussions. Such discussions would only be intended to obtain further clarification of potential capability to meet the requirements, including any development and certification risks.

QUESTIONS:

Questions regarding this announcement shall be submitted in writing by e-mail NLT 12 July 2024, 1:00PM (CT) to carrie.e.bair.civ@mail.mil. Verbal questions will NOT be accepted. Answers to questions will be posted to Sam.gov. The Government does not guarantee that questions received after the requested date will be answered. The Government will not reimburse companies for any costs associated with the submissions of their responses.

DISCLAIMER:

This RFI is not a Request for Proposal (RFP) and is not to be construed as a commitment by the Government to issue a solicitation or ultimately award a contract. Responses will not be considered as proposals, nor will any award be made as a result of this synopsis.

All information contained in the RFI is preliminary as well as subject to modification and is in no way binding on the Government. FAR clause 52.215-3, “Request for Information or Solicitation for Planning Purposes,” is incorporated by reference in this RFI. The Government does not intend to pay for information received in response to this RFI. Responders to this invitation are solely responsible for all expenses associated with responding to this RFI. This RFI will be the basis for collecting information on capabilities available. This RFI is issued solely for information and planning purposes. Proprietary information and trade secrets, if any, must be clearly marked on all materials. All information received in this RFI that is marked “Proprietary” will be handled accordingly. Please be advised that all submissions become Government property and will not be returned nor will receipt be confirmed. In accordance with FAR 15.201(e), responses to this RFI are not offers and cannot be accepted by the Government to form a binding contract.