Attachment 1 - SPLUNK Professional Services PWS.pdf

PERFORMANCE WORK STATEMENT (PWS)

Splunk Implementation, Enhancement, and Maintenance

Space Rapid Capabilities Office (Space RCO)

1.0 GENERAL: This is a non-personnel services contract to provide Splunk implementation and enhancement configurations per Space RCO mission requirements. The Government shall not exercise any supervision or control over the contract service providers performing the services herein. Such contract service providers shall be accountable solely to the Contractor who, in turn is responsible to the Government.

1.1 Description of Services/Introduction: The contractor shall Splunk services as defined in this Performance Work Statement except for those items specified as government furnished property and services. The contractor shall perform to the standards in this contract.

1.2 Background: The Space RCO mission is to develop and deliver operationally dominant space capabilities at the speed of warfighting relevance. We expedite delivery and deployment of space capabilities in response to the Commander, US Space Command requirements. Space RCO employs four key operating principles for going faster in space acquisition: Short and narrow chain of command; early & consistent warfighter involvement; small Integrated and empowered program teams; and embedded functional support (HR, Contracting, Finance, IT, Security)

In order to efficiently accomplish its mission, Space RCO must have a robust and interactive network security platform configured to collect logs and perform backend analytics.

1.3 Objective:

• Tailor current Splunk instance for implementation, enhancement, and maintenance to meet network security requirements.

1.4 Scope: Splunk Professional Services (PS). Provide 80 hours of PS to tailor Splunk instance to meet Space RCO’s network security requirements.

Professional Services

• Implementation, enhancement, and maintenance (44 hrs)

• Project management (4 hrs)

1.5 Period of Performance: The period of performance shall be for one (1) Year or until the 44 hours have been exhausted.

1.6 General Information

1.6.1 Quality Control: N/A.

1.6.2 Place of Performance: The work to be performed under this contract will be performed virtually and from the Space RCO facility at Kirtland Air Force Base, Bldg 350 (all hours performed on-site).

1.6.3 Security Requirements: TS/SCI Clearance

1.6.7.1 PHYSICAL Security: N/A.

1.6.7.2 Key Control: N/A.

1.6.3 Special Qualifications: N/A.

PERFORMANCE OBJECTIVES

2.0. Performance Objectives:

2.1. Basic Services. The contractor shall provide 44 hours of Splunk PS.

2.2. Splunk PS Objectives

2.2.1. Requirements and design activities

2.2.2. Dashboard Development and Enhancement

o 2.2.2.1. Develop and maintain dashboards mirroring the information displayed on existing Windows dashboards for:

o (a) Red Hat Enterprise License (RHEL) Server connections and information relevant to Space RCO operations.

o (b) Switch connections and information relevant to Space RCO operations.

o 2.2.2.1.2. Create dashboards displaying accurate login/logoff counts for Space RCO systems, consolidated rather than itemized.

o 2.2.2.1.3. Develop a dashboard to visualize privilege escalation events within Space RCO systems, reflecting realistic counts.

o 2.2.2.1.4. Create dashboards monitoring forwarder performance and data transmission to Space

RCO clients.

o 2.2.2.1.5. Implement per-machine dashboards detailing user actions (access, creation, modification) and document creation within Space RCO systems.

o 2.2.2.1.6. Develop a dashboard for visualizing AU-5 and AU-6 assessment procedure results relevant to Space RCO operations.

o 2.2.2.1.7. Create a dashboard summarizing admin events by user within Space RCO systems, with realistic counts.

2.2.3. Event ID Management

o 2.2.3.1. Establish processes for ingesting, verifying, editing, adding, and removing specific Event

IDs relevant to Space RCO systems (included but not limited to):

4720,4722, 4725, 4726, 4738, 4625, 4624, 5379, 4670, 4663, 4674, 4688, 6416, 4656, 4728, 4737, 4697, 601, 7045, 516, 517, 612, 623, 806, 807,1101, 1102, 4621, 4694, 4695, 4715, 4719, 4817, 4885, 4902, 4906, 4907, 4912, 642, 646, 685, 4738, 4885, 4902, 4724, 4723, 628, 627, 529, 530, 531, 532, 533, 534, 535, 536, 537, 538, 539, 576, 4672, 4673, 577, 578, 6006, 6005, 800, 801, 805, 842, 307 o 2.2.3.2. Ensure dashboards accurately reflect the events listed in below for Space RCO systems.

A. Authentication events:

a. Logons (Success/Failure) Current function setting are returning too high of feedback or false positives.

b. Logoffs (Success) Functions currently too high of feedback or false positives

B. Security Relevant File and Objects events. Enable GPO functions to display below events a-c.

a. Create (Success/Failure)

b. Access (Success/Failure)

c. Delete (Success/Failure)

C. Export/Writes/downloads to devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure). Enable view of machines with media capabilities that performed export, write, or download functions.

D. Import/Uploads from devices/digital media (e.g., CD/DVD, USB, SD) (Success/Failure).

Enable view of machines with media capabilities that performed import and upload functions.

E. User and Group Management events:

a. User add, delete, modify, disable, lock (Success/Failure). A search parameter to tell me how many users have these functions/abilities and when they were used.

b. Group/Role add, delete, modify (Success/Failure) A search parameter to tell me how many users have these functions/abilities and when they were used.

F. Use of Privileged/Special Rights events:

a. Security or audit policy changes (Success/Failure)

b. Configuration changes (Success/Failure)

G. Admin or root-level access (Success/Failure) A search parameter to tell me who has these functions and when these individuals used them.

H. Privilege/Role escalation (Success/Failure) Functions too high of feedback or false positives

I. Audit and security relevant log data accesses (Success/Failure) J. System reboot, restart and shutdown (Success/Failure) K. Print to a file (e.g., pdf format) (Success/Failure). Display user activity data that performed a “Print to file” or exported to print device action.

2.2.4. Splunk Database Management

o 2.2..4.1. Implement archival and deletion parameters for the Splunk database to optimize storage and performance, considering Space RCO data retention policies.

2.2.5. Log Server Configuration and Optimization

o 2.2.5.1. Correct or create and configure a new log server for ingesting application and *nix-based operating system logs relevant to Space RCO systems.

o 2.2.5.2. Configure the log server to forward logs to the Space RCO Splunk server securely.

o 2.2.5.3. Implement archival of log data and provide comprehensive documentation on configuration and setup, tailored to Space RCO requirements.

2.2.6. Forwarder Configuration

o 2.2.6.1. Correct or reconfigure forwarder applications to ensure proper event forwarding from

Space RCO clients.

2.2.7. Certificate Management

o 2.2.7.1. Correct or reconfigure Secure Sockey Layer (SSL) certificates on the Splunk server and forwarders to use the Space RCO local Certificate Authority (CA) server for encryption.

2.2.8. Project Management

o 2.2.8.1 Preparation Activities:

o Review Space RCO documentation provided during pre-sales activities.

o Facilitate knowledge transfer from sales teams to the project team.

o Conduct introductory calls with the Space RCO project manager.

o Plan and host the Project Kickoff meeting.

o Schedule Installation and Design Workshop activities.

o 2.2.8.2 Ongoing Project Management Activities:

o Develop and maintain a detailed project management plan and schedule.

o Conduct regular project status meetings with Space RCO stakeholders to review progress, address issues, and manage risks (frequency to be mutually agreed upon).

o Provide regular written reports to Space RCO summarizing project status, schedule, financials, issues, and risks.

o Ensure clear communication and collaboration between the project team and Space RCO stakeholders.

o Monitor project progress against established timelines and performance criteria.

o Identify and proactively address any deviations from the plan.

o Ensure that all deliverables meet the acceptance criteria outlined in Section 3.

3. Deliverables o 3.1. Functional dashboards meeting the specifications outlined in section 2.2.2., tailored to Space RCO needs.

o 3.2. Documented processes for Event ID management specific to Space RCO systems.

o 3.3. Implemented archival and deletion parameters for the Splunk database aligned with Space RCO data retention policies.

o 3.4. Configured log server with forwarding and archival capabilities, along with comprehensive documentation specific to Space RCO requirements.

o 3.5. Configured forwarder applications for reliable event forwarding within the Space RCO environment.

o 3.6. SSL certificates configured on the Splunk server and forwarders using the Space RCO local CA server.