Domain_Intelligence_Software_Requirements_Information.xlsx
XLSX spreadsheet 16 KB Posted
- Attached to
- Domain Intelligence Software
- Solicitation number
- ITSO200001
- Issued by
-
The Judicial Branch
About this file
Domain Intelligence Software Requirements Information Spreadsheet
View the file
On GovTribe
Work with this file
- Download the original file
- Contacts named in this file
- Similar government files
- Ask GovTribe AI about this file
Text version
Sheet1
| Vendor Name: | |||
| Product Name: | |||
| Requirement # | Requirement Description | Please mark with an X those requirements that your product can meet: | Please describe how the product meets this requirement. If the product does not meet the requirement, please describe the reasons. |
| 1 | The AOUSC requires information on Registration Dates, Registration Locations, Registration Countries and associated certificates for all domains that are being used on the Internet and the ability to enrich all U.S. Court's network traffic with a risk rating for each of those domains. | ||
| 2 | The software must be on a modern platform with a secure application program interface (API) to enable transfer of domain intelligence to any AOUSC system. | ||
| 3 | The software/service must integrate with the AOUSC’s Security Incident and Event Management (SIEM) solution, Splunk Enterprise Security (Splunk), to provide automated Domain intelligence directly to the AOUSC’s threat analysts. The only software that can be installed is the actual Splunk Add-On/plug-in. | ||
| The following requirements must be performed within the Splunk SIEM Application: | |||
| 4 | The software must be capable of alerting on domains that closely resemble legitimate U.S. Court domains but are not controlled by the U.S. Courts. | ||
| 5 | The software must provide an advanced query capability for domain intelligence that allows analysts to search by length of registration, risk score, observed malicious activity from the domain, or malicious activity category. | ||
| 6 | The software must have the ability to provide automated correlation for any domain activity associated with Advanced Persistent Threats. | ||
| 7 | The software must provide intelligence on the contents of SSL and TLS certificates to assess trustworthiness or risk level of the domain hosting the certificates. It must also be capable of identifying other domains that are also using the same certificate(s). | ||
| 8 | The software must provide access to current and historical registration and hosting data (WHOIS) that analysts can access, analyze, and make pivots, correlations and deductions. | ||
| 9 | The software must contain information for all registered domains and be updated within 48 hours of new domain registration. | ||
| 10 | The software must provide domain reputation scoring via a consistent threat methodology. The software must be capable of providing a risk score for all domain activity that accurately reflects the threat of malicious activity resulting from AOUSC interaction with a domain. The software must provide external context to domain information associated with internal logs and alerts and provide insights to analysts that enable them to analyze, ascertain the relative risk and respond. Additionally, it must provide predictive analysis regarding the relative risk of observed domains even if no malicious activity has ever occurred on the domain by comparing newness, location, registrar and certificate information. | ||
| 11 | The software must be able to take information associated with a domain and use it to find other domain activity that matches characteristics such as shared hosting, registrar, time or certificates. This must be done automatically and at scale across all observed network traffic. |
File details come from the government source that posted it.