The file's text, extracted by GovTribe without its formatting.
Request for Proposal (RFP) OISR202000001 “ Virtual Security Operation Center (V-SOC) Services” Attachment 4: Question and Answer Template
| Question No. |
| RFP Section and Paragraph |
| Question |
| 1. |
| Section 1.2.3 |
| Is USCP expecting the security engineer to perform upgrades, patches, and general maintenance to the SIEM? |
| 2. |
| 1.2.3./1.2.3.2. |
| What is the estimated level of effort and / or scope of engineering work for the evaluation and tuning of the SIEM? |
| 3. |
| 1.2.3./1.2.3.2. |
| Is this an engineering project (one-time) or an ongoing service? |
| 4. |
| 1.2.3./1.2.3.2. |
| Is dashboard creation for event correlation ad hoc? |
| 5. |
| Section 1.4.2 |
| Will the V-SOC only be working alerts within Splunk or will alerts be worked in other tools? |
| 6. |
| 1.4.2.3/1.4.2.3.2. |
| Would CrowdStrike console access be provided to the VSOC analysts so more in-depth searches can be performed during an investigation? |
| 7. |
| 1.4.2/1.4.2.3. |
| Outside of the future implemented technologies listed, are there any additional log types or sources which will be implemented into the SIEM? |
| 8. |
| Section 1.4.2.3.1 |
| Will the logs from the tools listed in this section be feeding into Splunk? |
| 9. |
| 1.2.2.1 |
| Can USCP share its current volume (without detail) of critical, high and medium alerts, that you are seeing on a daily, weekly, monthly, annually average? |
| 10. |
| 1.2.2.3 and 1.4.2.3.2 |
| We would like to confirm CrowdStrike is in scope as a data feed for Splunk Monitoring only. (There is no expectation of active management of CrowdStrike) Please confirm the number of endpoints that are feeding into Splunk Monitoring. Does the CrowdStrike Falcon implementation include OverWatch Threat Hunting? |
| 1.4 |
| Can you provide quantities of the devices listed by site? |
| 1.4 |
| Can you provide guidance as to how well the existing infrastructure is tuned and areas of focus that Offeror may need to focus on during the initial takeover of the existing environment? Also, to what extent USCP will provide hands-on management and configuration of the security tools. |
| 1.4.2 |
| Can you please provide the volume of log data (in GB per day) currently output from these tools? |
| 1.4 and1.5 |
| What are the limitations for remote monitoring and accessing the system? (MFA, Concurrent connection restrictions, Geo-IP blocking, etc.) |
| 1.4.2 |
| Is there a preferred method for accessing the systems (VDI)? |
| 1.2.2.1 |
| Are there Splunk event categories that you are currently suppressing due to high false positive rates or not a priority for USCP? |
| General |
| Can you please describe how swimlanes are currently integrated into the USCP environment for orchestration events? (I.e., integrated with Palo Alto to automatically implement IP blocks) |
The Legislative Branch