SOW.pdf

STATEMENT OF WORK

Defense Security Service

Counterintelligence Division DomainTools

The Defense Security Service (DSS) has a requirement to access a database through a set of comprehensive searchable tools that can provide the rich Domain/Internet Protocol (IP) information needed to support DSS’s counterintelligence (CI) mission to leverage the aggregation of data from public registration of domains and IP addresses and use this data to identify malicious actor tactic, techniques, and procedures and Command and Control Infrastructure. It must provide access to a commercial business database that features general search, monitoring, and unique screening capabilities for domestic and international-based business entities. The database must provide various search tools such as domain research tools, Domain Name System (DNS) research tools, historical tools, and proactive monitoring tools.

Additionally, access to Domain Tools with the IRIS Investigation Platform is required and is directly critical to the Cyber Division’s Joint Cyber Intelligence Tool Suite (JCITS) project. JCITS is a predictive analysis process incorporating the results of numerous tool for producing cyber threat intelligence to proactively disrupt cyber anomalies against cleared industry networks.

Database must contain following features:

1. Access to DomainTools IRIS Investigation Platform enables DSS Counterintelligence Cyber Division (CICD) utilization of advertised features to include the following:

a. Unlimited user account creation for DSS employees and/or subcontractors for collaboration within DomainTools IRIS Investigation Platform environment.

b. Access to the DomainTools IRIS Investigation Platform per user account for searching registrant information to include performing Whois Lookup, Bulk Parsed Whois, Whois History, Hosting History, Domain Search, Reverse Whois, Reverse IP Whois, Reverse IP, Reverse Name Server, Reverse MX, Brand Monitor, Name Server Monitor, Registrant Monitor, IP Monitor, Domain Monitor, and other comparable features.

c. Expand or narrow down searches or expected results based on the application of BOOLEAN-based conditional search statements during query events.

d. “Pivot” from any data point (resolved from 1.b) to adjoining data points without decoupling the relevancy of connected interests.

e. Interactive pivot with pDNS feature to map correlated results for associations to current or historical relationships of targeted point of interest(s) with the ability to score risk factors.

2. Application Program Interface (API) credentials for API-based connections to enable seamless integration with DSS-owned or DSS-sponsored tools or projects for enhancing real-time analysis and enabling up-to-date awareness of attack vectors. API-based accesses shall support queries over authenticated connections up to the maximum allowable transactional units lasting for the duration of the contract.

3. Access to DomainTools “legacy” capabilities without the IRIS Investigation Platform includes the following:

a. Ability to search fields located within the WHOIS datasets of domains and IP. Must provide the following search abilities: WHOIS lookup, Reverse WHOIS, Reverse IP lookup, Domain search, Reverse Name Server lookup, Reverse IP WHOIS, Reverse mail server lookup.

b. Ability to review 400 million or more historical or current domain names.

c. Ability to search 2 billion or more DNS data points. The data points must include: WHOIS history, Hosting history, IP history.

d. Ability to provide historical Screenshots of suspicious domains.

e. Ability to provide proactive monitoring tools. The monitoring must consist of: 50 Name Server monitors, 50 Brand monitors, 50 Domain registrant monitors, and 50 IP monitors.

Must provide an API to Maltego and provide access to pre-built transforms to interact with the vendor data with the Maltego Program. Note the inclusion of Maltego +API feature within the contract; this capability is still a critical requirement to JCITS development.

Performance location: 27130 Telegraph Road, Quantico, VA 22134

Period of Performance: Base twelve month period with one twelve-month month option period.