A04_SOW_1.pdf

Haskell Indian Nations University 155 Indian Avenue

Lawrence, KS 66046

STATEMENT OF WORK

SentinelOne Endpoint Protection

INTRODUCTION

Haskell Indian Nations University (HINU) provides network connectivity to over 900 students and 160 employees who access data and resources crucial to their academic success and conducting daily business tasks. The security, integrity and availability of this data and the devices on which these resources are accessed is of great importance and priority of the university. A FedRAMP authorized, scalable, cost-effective and analytical-based endpoint protection solution would provide complete visibility across the entire network and ensure greater protection from threats like data loss and data leakage through technologies integrated into such a platform which includes data encryption and data access controls.

OVERVIEW

HINU seeks to contract for the implementation of the Singularity Data Lake solution by SentinelOne on the KanREN network, the non-BIE (ENAN II) network on the Haskell campus. Solution is a unified data lake designed to centralize and transform data into actionable intelligence for real-time investigation and response. The solution will offer key features for protection, location, examination and remediation of endpoint devices such as computers, smartphones, printers, security cameras and other networked devices to prevent and mitigate vulnerabilities to safeguard sensitive data, prevent data breaches, ensure compliance with DOI regulations and policies, and improve HINU’s security posture.

OBJECTIVES

Key features offered by the Singularity Data Lake will be:

1. Infinite Scalability – ability to ingest all security and IT data from any source and store it for as long as needed without the need for rebalancing nodes, expensive retention management, or reallocating resources;

2. Complete Visibility – provide full-stack log analytics to keep critical data ready, stored at reasonable, predictable costs and also streamline and monitor the analytics to scale across first and third-party insights. Visibility preempts issues and allows for resolution quickly via the SDL’s automation and customizable workloads;

3. Improved Security Posture – accelerate mean-time-to-response and remove threats completely with full event and long context, while automating responses with built-in alert correlation and custom STAR (Storyline Active Response) rules. This will also help HINU learn from historic data to proactively harden the perimeter and defend against future threats;

4. Actionable Security Insights – SDL will connect disparate, siloed datasets to gain visibility into threats, anomalies and behaviors across the enterprise allowing quick response across first and third-party resources to contain and mitigate threats in their entirety, and also empowering analysts by ingesting data from any first or third-part source using pre-built connectors and automatically normalizing it using the Open Cyber Security Schema Framework (OCSF) standard;

5. FedRAMP High Authorization – SentinelOne’s Singularity Data Lake has achieved FedRAMP High Authorization demonstrating compliance with NIST SP 800-53 security controls and making SDL a robust solution enabling Haskell to meet stringent security and compliance mandates.

TASKS and DELIVERABLES

Contractor will successfully install and configure the following:

1. Singularity Platform

• Access to the Singularity Platform, includes initial SDL ingest, Federal, 1 year term, 12 months

2. Complete Protection Platform (per workstation)

• EPP + EDR, with NGAV (AI), Rogues IoT, Firewall control, Device control, Remote Shell, EDR

Hunting and Investigation and up to 100 concurrent STAR rules, Enterprise support plan, Federal, 1 year

3. Complete Cloud Workload Security (per server)

• EPP + EDR, with NGAV (AI), Rogues IoT, Firewall control, Device control, Remote shell, EDR

Hunting and Investigation and up to 100 concurrent STAR rules, Enterprise support plan, Federal, 1 year

4. Guided Onboarding for Singularity Endpoint (per endpoint)

• 90 days, Remote Deployment Assistance, Initial Threat Triaging, Ongoing Configuration Review and Health Checks, Designated Customer Success Engineer, Federal, 1 year, 500-1,000 Endpoints

Contractor will successfully accomplish the following tasks for guided onboarding of the Singularity AI SIEM:

1. Remote Deployment Assistance

• Includes up to 6 marketplace data sources (see Appendix page);

• Includes up to 4 non-marketplace data sources with custom parsers;

• Implementation of up to 2 custom dashboards;

• Implementation of up to 4 custom detections;

• 3 one-hour knowledge transfer sessions.

2. Project Duration

• Target duration of 9 weeks, with a maximum duration of 6 months.

3. Deliverables

• Console and Policy Configuration

• Initial Agency Installation

• User Enablement and product overview

• Review of threat analysis workflow

• Overview of implementation best practices

• Configuration and integration of up to 6 marketplace data sources;

• Configuration and integration of up to 4 non-marketplace data sources with custom parsers;

• Development and deployment of up to 2 custom dashboards tailored to the customer’s requirements;

• Development and deployment of up to 4 custom detections;

• Conducting 3 one-hour knowledge transfer sessions to ensure HINU’s IT team is well-versed in using the implemented solutions.

4. Engagement Process

• Initial scoping and requirement gathering with the customer;

• Validation of the package scope with the customer;

• Execution of the SOW and obtaining the necessary approvals;

• Deployment and configuration of the specified data sources, dashboards, and detections;

• Conduct knowledge transfer sessions.

5. Customer Responsibilities, HINU will:

• Designate a Project Manager or Point of Contact (POC) to work with contractor;

• Ensure all key IT, network, security, or other Customer personnel are accessible for meetings as necessary for the services;

• Provide contractor with a completed engagement questionnaire (i.e., org composition, major applications, integration points, etc) necessary for the services, prior to the commencement of services described in Statement of Work (SOW)

• Perform a full backup of all critical systems prior to the commencement of services.

• Fulfill responsibilities under the SOW, and if not fulfilled Contractor shall not extend the duration of the services.

PLACE OF PERFORMANCE

KanREN network virtual environment at Haskell Indian Nations University, 155 Indian Ave., Lawrence, KS.

PERIOD OF PERFORMANCE

Period of Performance is July 29, 2025 – July 28, 2026.

APPENDIX

List of all the marketplace sources available in the Singularity Marketplace:

1. Recorded Future - Automatically enrich, contextualize, and triage threats and Indicators of

Compromise (IoCs) using intelligence from 800,000+ sources.

2. Netskope - Connect threat blocklists for advanced threat protection from endpoint to cloud.

3. Armis - Unified asset intelligence, improved alert triage, and accelerated threat remediation across the entire attack surface.

4. Mandiant - Enrich detection, triage, and hunting with context and intelligence.

5. AWS Security Hub - 3rd-party hosted, 3rd-party listing.

6. Anecdotes - 3rd-party hosted, 3rd-party listing.

7. Arctic Wolf - Arctic Wolf Operations, 3rd-party hosted, 3rd-party listing.

8. Automox - Automox Worklets, 3rd-party hosted, 3rd-party listing.

9. Banyan - Banyan Security Service Edge, 3rd-party hosted, 3rd-party listing.

10. Cloudflare - 3rd-party hosted, 3rd-party listing.

11. CodeHunter - 3rd-party hosted, 3rd-party listing.

12. CyberArk - CyberArk Identity Flows, 3rd-party hosted, 3rd-party listing.

13. Drata - Drata Compliance Automation, 3rd-party hosted, 3rd-party listing.

14. Fidelis - Email Security and Network Security, 3rd-party hosted, 3rd-party listing.

15. Fletch - 3rd-party hosted, 3rd-party listing.

16. Glimps - 3rd-party hosted, 3rd-party listing.

17. Google Cloud Platform - Siemplify SOAR, 3rd-party hosted, 3rd-party listing.

18. IBM - IBM QRadar and IBM SOAR, 3rd-party hosted, 3rd-party listing.

19. Intezer - Autonomous SOC, 3rd-party hosted, 3rd-party listing.

20. Lumu - 3rd-party hosted, 3rd-party listing.

21. Palo Alto Networks - PANW Cortex XDR, 3rd-party hosted, 3rd-party listing.

22. Ping - Ping Directory and Ping Identity, 3rd-party hosted, 3rd-party listing.

23. Securonix - Securonix NG-SIEM, 3rd-party hosted, 3rd-party listing.

24. Sekoia - Sekoia.io SOC Platform, 3rd-party hosted, 3rd-party listing.

25. Splunk - Splunk Cloud, 3rd-party hosted, 3rd-party listing.

Examples of sources not currently part of the Singularity Marketplace include:

1. Palo Alto Firewall: This can be integrated via syslog.

2. Okta: This can be integrated via cloud-to-cloud (C2C) integration.

3. Nginx logs: These can be ingested using the SentinelOne collector reading logs on disk.

4. Fortigate Firewall: This can be integrated via syslog, potentially using an existing Splunk forwarder for syslog.

5. Microsoft Defender for Cloud: This can be integrated via cloud-to-cloud (C2C) integration.

These examples are typically integrated using methods other than the marketplace, such as syslog, cloud-to-cloud integrations, or custom ingestion methods.