Exhibit I_Functionality_Scoring_NDR_RFP_S-10700-00010923_FINAL_12062024.xlsx
XLSX spreadsheet 12 KB Posted
- Attached to
- Network Detection and Response (NDR) Solution
- Solicitation number
- S-10700-00010923
- Issued by
- Marion County, Oregon
About this file
This is a functionality scoring sheet for a Network Detection and Response (NDR) Solution RFP (S-10700-00010923) issued by the Oregon Department of Administrative Services Procurement Services (DAS PS) for Marion County. The document outlines the scoring criteria for various technical capabilities of the NDR solution, with a total of 2,350 possible points distributed across multiple functional requirements. Key capabilities being evaluated include Deep Packet Inspection (250 points), real-time network traffic analysis (250 points), north/south and east/west traffic monitoring (250 points), and real-time monitoring and alerting capabilities (250 points).
The scoring matrix emphasizes critical security features including behavioral analysis (200 points), machine learning capabilities (200 points), network traffic modeling (200 points), and customizable policies and rules (200 points). Additional requirements include forensic capabilities (150 points), User and Entity Behavior Analytics (150 points), signature-based detection (100 points), automated responses (100 points), continuous monitoring (100 points), and compliance support (100 points). The document specifies that the State prefers a SaaS, IaaS, or COTS solution, and the contract will be awarded to a single vendor.
View the file
Other files
Show all 22
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Functionality | Max Points | Points Awarded |
| Deep Packet Inspection (DPI): The solution is capable of analyzing network traffic at the packet level to detect and understand the details of communication. | 250 | |
| The solution can analyze raw network packet traffic or traffic flows (for example, IP flow information export [IPFIX] or NetFlow records) in real time or near real time. | 250 | |
| The solution is capable of monitoring and analyzing north/south traffic (as it crosses the perimeter), as well as east/west traffic (as it moves laterally throughout the network). | 250 | |
| The solution is capable of providing behavioral analysis: Implement behavioral analytics to identify deviations from normal network behavior, helping to detect anomalies and potential security threats. Explain role of behavioral analysis in identifying anomalies or potential security threats. How is behavior analysis used in your solution? | 200 | |
| The solution supports signature-based detection: Utilizing signature-based detection mechanisms to identify known threats and patterns of malicious activity. | 100 | |
| The solution is capable of machine learning: Incorporates machine learning algorithms to continuously improve threat detection capabilities, adapt to new attack methods, reduce false positives, and to baseline normal activity and detect abnormal behaviors. | 200 | |
| The solution is capable of modeling normal network traffic and highlight suspicious traffic that falls outside the normal range for north/south and east/west traffic patterns. What is the typical baseline period? What is the baseline process? Is it automatic or guided? What support will be provided by the Offeror for baselining? Is baselining support included in pricing or additional? | 200 | |
| Results from (both network environments and incident detection) are comprehensible and comprehendible. Describe how the Solution provides results in easily understandable and comprehensive formats. | 100 | |
| Real-time Monitoring: Provide real-time monitoring and alerting capabilities to quickly respond to and mitigate security incidents as they occur. Provide use cases how this is achieved through the Solution - e.g. Detecting threats, Assisting with triage/analysis, and/or threat containment and interruption. | 250 | |
| Guided Threat Hunting: Enables SOC Analysts to take provided intelligence and move forward to hunt for threats based on what the NDR provides within a templated/guided framework. Describe how the Solution provides guided threat hunting. | 100 | |
| Forensic Capabilities: Enable the capture and analysis of historical network data for incident response and forensic investigations. What is required for the Solution to capture and analyze historical network data? How much data can be captured? Is it based upon events? How long can it be retained? | 150 | |
| User and Entity Behavior Analytics (UEBA): Incorporate UEBA to analyze the behavior of users and entities within the network, identifying potential insider threats or compromised accounts. | 150 | |
| Customizable Policies and Rules: Allow administrators to define and customize security policies and rules based on the specific needs and risk profile of the organization. | 200 | |
| Automated responses, such as host containment (through integration) or traffic blocking | 100 | |
| Continuous Monitoring: Provide continuous monitoring and analysis of network traffic, ensuring that security teams have real-time visibility into the network activities. | 100 | |
| Compliance Support: Support regulatory compliance requirements by providing features and reports that aid in meeting industry-specific security standards. | 100 |
File details come from the government source that posted it. Updated .