Answers_to_QUESTIONS_RECEIVED_FOR_SIEM_RFI_16AUG13_(3).pdf

Questions/Answers Page 1

ATTACHMENT 1 TO AMENDMENT 1 OF RFI EXCH-ITZ-08-013-13-005

QUESTIONS RECEIVED FOR SIEM RFI 16AUG13 AND

ANSWERS 23AUG2013

What is meant by “typical” installation? Do you have any sizing factors to help answer this? Such as data volume? number of types of data sources (i.e. – firewalls, routers, web proxies, AD servers)? Do you have an existing data collection tool in place, such as a network of syslog servers?

We have a central repository for log data. Logs are collect using a number of collectors and combined in the central repository. We scale by Events Per Second (EPS). With a minimum of 6000 EPS and spikes of 25,000+ EPS.

3. The SIEM solution must support a minimum of 6000 Events per Second (EPS) with spikes in EPS of 25000 or more.

Do you know what your data volume averages and spikes would be in a 24 hour window?

Our product calculates on data volume ingested, not events per second.

We use EPS as a normal calculation, which is standard for SIEMs in the industry. Given a a max log packet size of 1,024 bytes, this would scale to 6,144,000 to 25,600,000 bytes per second.

4. The SIEM must have an integrated relational database in each SIEM system component.

Do you absolutely require an integrated relational database? Or are you simply asking for the ability to pull data from a relational database without relying on third party tools?

We need the ability to query data quickly, whether the source data is in a relational database or flat file. The driving factor is the speed at which the data can be queried.

Most modern SIEMs do not leverage Relational databases for speed and efficiency. It is actually not the best method available. Should Item 4 be changed to only dictate a database that is accessible by common SQL commands?

See above answer.

11. The SIEM must provide notifications via email, SNMP and SMS. Notifications must be based upon multiple conditions including alert rate (number of events within a specific amount of time) and configurable deviation from baseline.

Which version of SNMP? And, is it acceptable to leverage a third party tool to capture the SNMP traps?

SNMP v2c is our minimum approved version in our enterprise.

Questions/Answers Page 2

12. The SIEM must provide and maintain dynamic baselines for all IP addresses, users, hosts, domains, ports and protocols.

Please define and/or give examples of dynamic baselines.

Dynamic baselines means we need to aggregate data over time (hour, day, week, month, year, etc.) and show variances from previously baselined levels.

16. The SIEM must include standard FISMA reporting templates.

Do the FISMA reporting templates need to be SCAP templetes?

SCAP templates would be preferred for ease of import.

17. The SIEM must include network discovery and network topology capabilities.

Which type of network discovery? SNMP & which version of SNMP? PING? What sort of network topology capabilities are you asking for?

SNMP v2c as a minimum. PICMP ping is acceptable. The tool must support netflow.

19. The SIEM must be capable of receiving netflow, sflow, jflow and IPFIX data.

Which version of netflow? Can a third party tool integrate with our products in order to process flow data?

Minimum version for netflow must be v5 or higher. Yes, third party tools can be used, but seamless integration is paramount.

20. The SIEM must be capable of detecting network-wide anomalies and provide user profiling across disparate devices.

Please define and/or give examples of network-wide anomalies. Also, what is the nature and extent of user profiling?

Spikes in traffic volume for individual users compared to others. Spikes in overall traffic volume. User profiling would give the traffic and events associate per user.

22. The SIEM must be able to communicate with (e.g.; disable ports or change VLAN assignments) network devices (e.g.; LAN Switches) directly from the management console using SNMP.

Which version of SNMP? Most environments use the SIEM to generate tickets for their network shop, letting the network shop handle management of the devices. Would this be an acceptable alternative to this requirement? Or, would allowing the appropriate searches to fire off scripts suffice?

Questions/Answers Page 3

SNMP v2c as a minimum. Native ability or the ability to generate and send configuration scripts is preferred.

23. The SIEM must provide an embedded relational data management system which is both self-maintaining and self-pruning.

Do you absolutely require an integrated relational database? Or are you simply asking for the ability to pull data from a relational database without relying on third party tools?

No. Speed is paramount to data queries. Native querying is preferred whether it be from a flat file or relational database.

24. The SIEM database must process over 25 concurrent database table indices.

Is this requirement in response to being able to pull data from said database? Or is it intended for RDMS based solutions?

Any method to quickly query data and provide responsive reporting is preferred. Speed of data retrieval is paramount.

25. The SIEM must be appliance based and not require professional services or code development for any required customization.

Can you provide some examples of likely customizations? What is meant by “appliance” in this instance?

We would prefer appliances, but Virtual Machines may be used if the VM can sustain rates for data collection and analysis. The solution should avoid the need for database engineers to tune custom queries.

26. The SIEM must be capable of interfacing with vulnerability assessment scanning tools.

What interfacing specifically is required? To be able to analyze and correlate results? Or to directly manage the tools?

We require the ability to import vulnerability scan data and relate SIEM reports and alerts to this data. We currently use McAfee Vulnerability Manager as our vulnerability scanning tool. The solution must seamlessly integrate with this tool to correlate results of vulnerability scans.

29. The SIEM must be able to integrate with Microsoft Active Directory (AD) authentication and map user groups to user permissions.

Is the purpose of this integration simply the authentication and authorization of users of the SIEM, or is there another purpose?

Questions/Answers Page 4

Yes. We require single sign on and user management through AD.

41. The SIEM must provide an optional VM-ware based log collection capability.

Can you further define VM-ware based log collection capability? What is this function doing and why must it be VM-ware based?

The SIEM must provide the ability for the log collectors to be running on either appliance-based, hardware-based or VM-based platforms to allow collection from multiple environments.

42. The SIEM must provide an optionally integrated sensor appliance that is both configurable and manageable from the central system SIEM console.

Can you describe the functions performed by the integrated sensor appliance? Are there use-cases which describe its functions? This appears to be a vendor specific requirement!

Would it be ok to engineer a solution using a third party sensor that feeds our product?

A third party solution is acceptable.

43. The SIEM must provide an optional integrated Database Access Monitoring capability that is configurable and manageable from the central system console.

Can you describe the functions performed by the integrated Database Access Monitoring capability?

We require the ability to collect database logging and optionally capture database traffic.

44. The SIEM must provide an optional integrated Content Inspection capability that can monitor (actively decode) both Local Area Network application and protocol traffic and apply content triggers to rules-based correlation alerting.

Please provide more detail about this requirement, as it appears specific to a particular vendor and not the government’s technical capability requirements. Would it be okay to engineer the use of a third party Network Intrusion Prevention System that could feed data into our product for analysis?

Yes. We would like the ability to understand application behavior by monitoring and feeding SIEMN data to correlate by any working method.

45. The SIEM appliance hardware appliances must be manufactured in the USA.

Manufactured in the USA? –

Please remove this requirement.

Questions/Answers Page 5

47. The solution must be able to integrate with McAfee E-Policy Orchestrator (ePO) including Policy Auditor and Risk Advisor (MRA) to create risk scores.

Do you want it to feed ePO or receive data from ePO for analysis/reporting purposes?

Receive data for analysis and reporting.

48. The solution must be able to receive logs directly from the HBSS agent without access to the EPO server.

Please provide more detail about this requirement, as it appears specific to a particular vendor and not the government’s technical capability requirements.

One factor in collecting log and other information from remote locations is the bandwidth between locations. It dictates the need for a local collector vs forwarding the information back to HQ. Assuming an RFP is created, will the environment be described in more detail?

We require the ability to collect data for individual systems whether it be from an agent or

WMI.

49. The solution must be able to dynamically create a topology and allow for drilldown to the port level for each switch and router.

Which version of SNMP do you have deployed? Is there a solution in place to gather this information already such as Solarwinds Orion?

SNMP v2c as a minimum. Third party or native integration is acceptable.

50. The solution must be able to interact with switches and routers to allow for disabling ports or moving them into a quarantine VLAN.

Is the use of scripts allowed?

Yes

The questions below are generic and did not correspond to any of the requirements that were in the RFI but still need to be answered:

1) What is meant by “typical” installation?

A distributed installation in a high-availability enterprise environment.

2) Do you have any sizing factors to help answer this? Such as data volume? Number of types of data sources (i.e. – firewalls, routers, web proxies, AD servers)?

Questions/Answers Page 6

We can provide specific numbers of devices, but our EPS volume figures of 6,000-25,000 EPS should help accurately scale this solution. This is a standard distributed corporate environment for an enterprise network.

3) Do you have an existing data collection tool in place, such as a network of syslog servers?

Yes.

4) How long does it take to collect and normalize data?

Data collection varies by system and log collection need. We require the collected data be normalized and consumed by the SIEM within minutes or hours of collection.

5) How long does it take to produce a list of anomalies with the SIEM solution after gathering of logs and events?

normalized and consumed by the SIEM within minutes or hours of collection

6) How often is data collected and normalized to produce the list of anomalies. (1 time per day, 1 time per week)?

normalized and consumed by the SIEM within minutes or hours of collection

7) What is the current process in place for tracking down anomalies that are produced by the SIEM to find actual events?

We use multiple tools and are seeking a solution to reduce time-frames for event investigation.

8) How long does it take the SIEM solution to normalize the behavioral analysis to produce a list of anomalies with an acceptable rate of false positives?

This depends on the event and the data collected. Some data is processed within seconds of the event.

Questions/Answers Page 7

9) What additional network bandwidth requirements are needed on the network to accommodate the thousands of logs and events needed to support the SIEM solution?

None. Bandwidth limitations are currently not an issue with log collection.

10) What is the total number of alerts that are false positives each day?

This varies.

1. In order to provide a list price configuration specifically for AAFES, please provide the following:

a. Number of log source devices and applications –

Estimated: 50,000

b. Average events per second (EPS) –

6,000

c. Peak EPS – 25,000 (but scalable for growth)

d. Average log message length (in bytes) 512-1,024 bytes

e. Desired log retention period (in months) – 12-84 months depending on system and data type. Average is 12 months.

f. Number of operators who will be doing analysis and/or investigation of alerts –

8-12 security operations users with an additional 25-50 IT system owners.

g. Anticipated growth rate for items above.

Normal growth of 10-20% annually.

2. The RFI addresses virtual log collectors; how many are required?

5-20, but will depend on the collectors ability to process logs.

3. Regarding flow information, please provide the following:

a. Number of physical locations where network data packet information will be monitored (network aggregation points) – Two locations. (Corporate HQ and Disaster Recovery site.)

b. Number of network segments to be monitored per location

We are highly- distributed network environment. We have over 2,000 remote locations all aggregating to our corporate headquarters.

c. Average sustained network data packet transmission rate (in megabits/second) per segment for each of the locations above.

100 Mbit/second

d. Maximum sustained network data packet transmission rate (in megabits/second) per segment for each of the locations above This varies.

e. Desired retention period for flow data (in days)

30 days.

11) How long does it take to tune the SIEM tool to produce an acceptable rate of false positives (1 year, 1.5 years)?

Questions/Answers Page 8

6-12 months.

12) How many full time Equivalents will be needed to support the SIEM solution?

Unknown.

13) How many servers are being monitored? –

Up to 5,000.

14) How many network devices (routers, switches, access points, etc.) are being monitored?

Up to 15,000.

15) How many workstations are going to be monitored?

25,000

16) How many POS systems will be monitored?

5,000

17) What is the expected reasonable time to expect the analyst to limit his or her investigation to the data sources reported per alert?

This would vary, but an average event should be handled in under 5 minutes.

18) If you get a correlation rule wrong, how do you adjust the model and re-analyze the data?

We would require data to be re-analyzed if a correlation rule is incorrect. How that data is re-analyzed would vary by SIEM solution.