SPLUNK RFI QA.pdf
PDF 61 KB Posted
- Attached to
- SPLUNK Professional Services
- Solicitation number
- FA254824RB002
- Issued by
-
Department of the Air Force
About this file
This document is a Request for Information (RFI) for Splunk professional services issued by the Department of the Air Force. The key details are:
The RFI is for Splunk implementation and enhancement services, including ingesting data from various sources, creating dashboards and reports, and addressing performance issues with the current Splunk setup. The government is seeking 12 months of support, with no specific hours requirement. Security requirements include adherence to NIST 800-53 Rev. 5 Event Logging guidelines. The work must be performed on-site at Kirtland AFB, with access managed through a VMware instance. No additional security clearances or certifications are required beyond a TS/SCI clearance. Responses must be submitted by July 26, 2024, and the acquisition is set-aside for small businesses under the $34 million NAICS code 541519 - Other Computer Related Services.
View the file
Other files
| File | Type | Posted |
|---|---|---|
| SPLUNK Professional Services PWS - Revision 1.pdf | ||
| Attachment 1 - SPLUNK Professional Services PWS.pdf |
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
SPLUNK Q&A
1. Are all the necessary source types or data sources for dashboard creations already being ingested into the Splunk instance?
a. No we are not receiving any logs from workstations and they would have to be included.
2. Are all the data fields needed for creating the dashboards being parsed correctly?
a. No. Since the there are no instances of users being shown on the instance for logon type as users are supposed to be type 2/3 and don’t get either of those.
3. Is the Splunk environment being currently used, or is this a net new Splunk environment?
a. This Splunk environment is currently being used. However, if easier a new
Splunk environment can be created.
4. What is the current ingest amount (GB's/TB's?) and what is the ingest license?
a. 20Gb.
5. Approximately how many forwarders are currently deployed?
a. 11 are operational.
6. How many endpoints exist in the environment that will require forwarders?
a. 45.
7. Section 1.4 and 1.5 of the initial PWS indicated that the government’s intent was for
44 – 80 hours of work total, however that was removed in the revised PWS. Can you please confirm that the government’s vision is for 12-months of support and not just 80 hours?
a. The vendor is expected to provide the number of hours required to complete the tasks listed in the PWS.
8. Could you provide more details on the specific security requirements for the Splunk instance?
a. All requirements that fall under AU-2 of NIST Publication 800-53 Rev. 5, Event Logging requirements.
9. Are there any preferred methodologies or frameworks for Splunk implementation and enhancement?
a. Not currently.
10. Do you prefer a specific format or structure for the dashboards and reports?
a. No.
11. Can you elaborate on the key performance metrics that will be used to evaluate the success of this project?
a. Individuals logged on and what is accessed. Data ingest from forwarders and testing of specific events to include but not limited to privilege escalation, user logon, and Active Directory modifications.
12. Do you want us to address any existing pain points or challenges with the current Splunk setup?
a. Logons and logoffs are excessively high. Services are counted as individuals.
13. Are there any particular versions or configurations of Splunk that we need to be aware of for this project?
a. Will need to be on a windows server 2019 not RHEL, and will need to have
SSL certs issues by local CA configured not Splunk.
14. Will there be any specific integration requirements with other tools or platforms used by Space RCO?
a. Will need to ingest data from VMware and McAfee EPO server.
15. What are the working hours and access protocols for on-site work at Kirtland AFB?
a. 0700-1800 Mountain Time.
16. Are there any particular protocols for remote work, and how will access to necessary systems be managed?
a. Systems will be managed from a workstation inside the building and will remote into a VMware instance of the server.
17. Is there flexibility to perform the work remotely or in a hybrid manner (combining on-site and remote work)?
a. No.
18. Are additional security clearances or certifications required beyond the TS/SCI
Clearance?
a. Vendor on keyboard: No additional security/certification requirements.
b. Vendor off keyboard (providing guidance to SpRCO technicials): No security or certifications are required.
c. Recommend structuring quotes for both scenarios.
19. Will any specific security training or briefings be provided to our team?
a. No. Technicians will be escorted by SpRCO personnel.
File details come from the government source that posted it. Updated .