Attachment 1 - PWS SPLUNK Professional Services.pdf

PERFORMANCE WORK STATEMENT (PWS)

Splunk Implementation, Enhancement, and Maintenance

Space Rapid Capabilities Office (SpRCO)

1.0 GENERAL: This is a non-personnel services contract to provide Splunk implementation and enhancement configurations per SpRCO mission requirements. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall provide Splunk services as defined in this Performance Work Statement (PWS) except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background: The SpRCO mission is to develop and deliver operationally dominant space capabilities at the speed of warfighting relevance. We expedite delivery and deployment of space capabilities in response to the Commander, US Space Command requirements. SpRCO employs four key operating principles for going faster in space acquisition: Short and narrow chain of command; early & consistent warfighter involvement; small integrated and empowered program teams; and embedded functional support (HR, Contracting, Finance, IT, Security).

In order to efficiently accomplish its mission, SpRCO must have a robust and interactive network security platform configured to collect logs and perform backend analytics.

1.3 Objective:

• Tailor current Splunk instance for implementation, enhancement, and maintenance to meet network security requirements.

1.4 Scope: Splunk Professional Services (PS). Provide the number of hours of PS to tailor Splunk instance to meet SpRCO’s network security requirements. SpRCO has the original software image in the event a complete re-install is needed/suggested.

Professional Services

• Implementation, enhancement, and maintenance

• Project management

1.5 Period of Performance: The period of performance shall be no longer than ninety (90) days.

1.6 General Information

1.6.1 Quality Control: N/A.

1.6.2 Place of Performance: The work to be performed under this contract will be performed virtually and from the SpRCO facility at Kirtland Air Force Base, Bldg 350 (all hours performed on-site). The contractor is expected to provide travel and per diem costs as a separate itemized expense in their RFP response.

1.6.3 Security Requirements: None. Vendor’s technician will review settings and instruct SpRCO system administrators on the necessary changes to complete the PWS tasks. A DD 254 is not required.

1.6.7.1 Physical Security: N/A.

1.6.7.2 Key Control: N/A.

1.6.3 Special Qualifications: N/A.

PERFORMANCE OBJECTIVES

2.0. Performance Objectives:

2.1. Basic Services. The contractor is expected to provide the number of hours to perform the Splunk PS tasks in their RFP response.

2.2. Splunk PS Objectives.

2.2.1. Requirements and design activities

2.2.2. Dashboard Development and Enhancement

o 2.2.2.1. Develop and maintain dashboards mirroring the information displayed on existing Windows dashboards for:

o (a) Red Hat Enterprise License (RHEL) Server connections and information relevant to SpRCO operations.

o (b) Switch connections and information relevant to SpRCO operations.

o 2.2.2.1.2. Create dashboards displaying accurate login/logoff counts for SpRCO systems, consolidated rather than itemized.

o 2.2.2.1.3. Develop a dashboard to visualize privilege escalation events within SpRCO systems, reflecting realistic counts.

o 2.2.2.1.4. Create dashboards monitoring forwarder performance and data transmission to SpRCO clients.

o 2.2.2.1.5. Implement per-machine dashboards detailing user actions (access, creation, modification) and document creation within SpRCO systems.

o 2.2.2.1.6. Develop a dashboard for visualizing AU-5 and AU-6 assessment procedure results relevant to SpRCO operations.

o 2.2.2.1.7. Create a dashboard summarizing admin events by user within SpRCO systems, with realistic counts.

2.2.3. Event ID Management

o 2.2.3.1. Establish processes for ingesting, verifying, editing, adding, and removing specific Event

IDs relevant to SpRCO systems (included but not limited to):

4720,4722, 4725, 4726, 4738, 4625, 4624, 5379, 4670, 4663, 4674, 4688, 6416, 4656, 4728, 4737, 4697, 601, 7045, 516, 517, 612, 623, 806, 807,1101, 1102, 4621, 4694, 4695, 4715, 4719, 4817, 4885, 4902, 4906, 4907, 4912, 642, 646, 685, 4738, 4885, 4902, 4724, 4723, 628, 627, 529, 530, 531, 532, 533, 534, 535, 536, 537, 538, 539, 576, 4672, 4673, 577, 578, 6006, 6005, 800, 801, 805, 842, 307 o 2.2.3.2. Ensure dashboards accurately reflect the events listed in below for SpRCO systems.

A. Authentication events:

a. Logons (Success/Failure) Current function setting are returning too high of feedback or false positives.

b. Logoffs (Success) Functions currently too high of feedback or false positives

B. Security Relevant File and Objects events. Enable GPO functions to display below events a-c.

a. Create (Success/Failure)

b. Access (Success/Failure)

c. Delete (Success/Failure)

C. Export/Writes/downloads to devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure). Enable view of machines with media capabilities that performed export, write, or download functions.

D. Import/Uploads from devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure).

Enable view of machines with media capabilities that performed import and upload functions.

E. User and Group Management events:

a. User add, delete, modify, disable, lock (Success/Failure). A search parameter to tell me how many users have these functions/abilities and when they were used.

b. Group/Role add, delete, modify (Success/Failure) A search parameter to tell me how many users have these functions/abilities and when they were used.

F. Use of Privileged/Special Rights events:

a. Security or audit policy changes (Success/Failure)

b. Configuration changes (Success/Failure)

G. Admin or root-level access (Success/Failure) A search parameter to tell me who has these functions and when these individuals used them.

H. Privilege/Role escalation (Success/Failure) Functions too high of feedback or false positives

I. Audit and security relevant log data accesses (Success/Failure) J. System reboot, restart and shutdown (Success/Failure) K. Print to a file (e.g., pdf format) (Success/Failure). Display user activity data that performed a “Print to file” or exported to print device action.

2.2.4. Splunk Database Management

o 2.2.4.1. Implement archival and deletion parameters for the Splunk database to optimize storage and performance, considering SpRCO data retention policies.

2.2.5. Log Server Configuration and Optimization

o 2.2.5.1. Correct or create and configure a new log server for ingesting application and *nix-based operating system logs relevant to SpRCO systems.

o 2.2.5.2. Configure the log server to forward logs to the SpRCO Splunk server securely.

o 2.2.5.3. Implement archival of log data and provide comprehensive documentation on configuration and setup, tailored to SpRCO requirements.

2.2.6. Forwarder Configuration

o 2.2.6.1. Correct or reconfigure forwarder applications to ensure proper event forwarding from

SpRCO clients.

2.2.7. Certificate Management

o 2.2.7.1. Correct or reconfigure Secure Sockey Layer (SSL) certificates on the Splunk server and forwarders to use the SpRCO local Certificate Authority (CA) server for encryption.

2.2.8. Project Management

o 2.2.8.1 Preparation Activities:

o Review SpRCO documentation provided during pre-sales activities.

o Facilitate knowledge transfer from sales teams to the project team.

o Conduct introductory calls with the SpRCO project manager.

o Plan and host the Project Kickoff meeting.

o Schedule Installation and Design Workshop activities.

o 2.2.8.2 Ongoing Project Management Activities:

o Develop and maintain a detailed project management plan and schedule.

o Conduct regular project status meetings with SpRCO stakeholders to review progress, address issues, and manage risks (frequency to be mutually agreed upon).

o Provide regular written reports to SpRCO summarizing project status, schedule, financials, issues, and risks.

o Ensure clear communication and collaboration between the project team and SpRCO stakeholders.

o Monitor project progress against established timelines and performance criteria.

o Identify and proactively address any deviations from the plan.

o Ensure that all deliverables meet the acceptance criteria outlined in Section 3.

3. Deliverables o 3.1. Functional dashboards meeting the specifications outlined in section 2.2.2., tailored to SpRCO needs.

o 3.2. Documented processes for Event ID management specific to SpRCO systems.

o 3.3. Implemented archival and deletion parameters for the Splunk database aligned with SpRCO data retention policies.

o 3.4. Configured log server with forwarding and archival capabilities, along with comprehensive documentation specific to SpRCO requirements.

o 3.5. Configured forwarder applications for reliable event forwarding within the SpRCO environment.

o 3.6. SSL certificates configured on the Splunk server and forwarders using the SpRCO local CA server.