JA VirusTotal_Redacted.pdf

VirusTotal Intelligence Software Professional Bundle Control Number VA-24-00011253

JUSTIFICATION

FOR AN EXCEPTION TO FAIR OPPORTUNITY

1. Contracting Activity: Department of Veterans Affairs (VA)

Office of Procurement, Acquisition, and Logistics Technology Acquisition Center 23 Christopher Way Eatontown, NJ 07724

2. Description of Action: The proposed action is for a firm-fixed price (FFP) delivery order issued under the National Aeronautics and Space Administration (NASA) Solutions for Enterprise-Wide Procurement (SEWP) V Government-Wide Acquisition Contract (GWAC) for brand name VirusTotal Intelligence Software- Professional Bundle which includes support.

3. Description of the Supplies or Services: The Department of Veterans Affairs (VA), Office of Information & Technology (OIT), Office of Information Security (OIS), Cyber Security Operations Center (CSOC) has a requirement to procure an annual subscription of Brand Name VirusTotal Intelligence Software- Professional Bundle.

The CSOC uses VirusTotal Intelligence (VTI) software for threat intelligence gathering and vetting of indicators. The free version of VTI is limited to 500 searches per day and 5 searches per minute. With additional Use Cases implemented into automation, there is need for increased search capability for the initial triage of all events. CSOC requires an annual subscription for Brand Name VirusTotal Intelligence Software (VTI) Professional Bundle to provide threat intelligence gathering and vetting of indicators with the capability of 10,000 application programming interface (API) script lookup per day, 1000 intelligence searches and 1000 downloads per month, five (5) - 90-day lookback Retro Hunt jobs per Month, 25 per month Hunting VTDIFF automatic YARA rule jobs, and associated support which encompasses access to VirusTotal trainings, live support during throughout the day, integrations help, and general technical support.

The Delivery of the software shall be within seven (7) days after receipt and processing of the delivery order. The period of performance for support shall be 12 months commencing from delivery of software.

4. Statutory Authority: Pursuant to Federal Acquisition Regulation (FAR) Subpart 16.505(a)(4), the following brand name requirement is being justified and approved as an exception to fair opportunity under the statutory authority of Section 41 U.S.C.

4106(c)(2) as implemented by FAR Subpart 16.505(b)(2)(i)(B), entitled “Only one awardee is capable of providing the supplies or services required at the level of quality required because the supplies or services ordered are unique or highly specialized”.

5. Rationale Supporting Use of Authority Cited Above: Based on market research, as described in section 8 of this justification, it was determined that limited competition is available among resellers for the required brand name VirusTotal Intelligence

Professional software licenses. The Government requires a single virus service solution that can be utilized across all CSOC teams and incorporated into many of our tools.

VirusTotal Professional brand name software is the only software that meets VA requirements through the following methods:

(1) Integrates with VA’s Security Orchestration Automation & Response (SOAR) platform which utilizes the Swimlane application and provides enrichment of data matching triggering events as identified through the SOAR solution benefiting Cyber Incident Response (CIR) through validation of triggered events reducing False Positive Reporting.

(2) Provides automatic pivoting between Indicators of Compromise (IOCs) using up-to-the-minute intel sources, as opposed to the current time-consuming pivoting reducing the time to investigate each IOC.

(3) Automates the following functions based on custom YARA signatures written by Cybersecurity Advanced Analytics Cyber Hunting & Threat Analysis (CHTA) team deployed in VTI: Malware upload detection (identifying additional factors related to known malware samples uploaded by others in the security community, matched via hash value); Discovery of threat types/sources which pose a significant threat to VA resources: Threat matching searches for enrichment of active investigations performed via internal OIS CSOC teams.

(4) Provides a comprehensive, historical event review which is essential for tracking Advanced Threats and Focused Operations threats allowing for recursive Domain data (identification of registration details over time) and File detection history showing AV solution identification rates over time and malware family and sample hash/string matching.

(5) Provides a resource for other internal OIS VA CSOC teams such as Cyber Threat Intelligence (CTI) for their threat intelligence gathering and vetting of indicators and can be directly integrated with CTI Threat Intelligence Platform (TIP) that will be used by all OIS VA CSOC teams for threat response and automation.

(6) Enables CSOC Cyber Incident Response (CIR) to leverage VTI for URL/Domain/IP analysis as part of their spam/phishing email investigations and be available to the Analyst without interruption.

(7) Enhances the Cyber Hunt Threat Analysis (CHTA) team’s ability to perform deeper and broader analysis of events while also permitting automation of detections made during proactive hunt operations. Hunt automation allows the OIS VA CSOC to perform at the Hunt Maturity Level 4 as opposed to Hunt Maturity Level 3 according to the SANS Hunt Maturity Model. Leveraging advanced lookup capabilities will also be directly correlated to multiple stages of the MITRE ATT&CK Framework for standardized threat hunting and attribution which gives the option to investigate/analyze deeper into the possible compromise from beginning to end. (ex: Initial Access (spearfishing links), Execution (Compiled HTML File, PowerShell, Scheduled Task, etc.), Persistence (browser extensions, library hijacking, etc.)) Being able to map existing VA security controls with enrichment by VTI directly to the MITRE ATT&CK

Framework improving VA’s understanding of adversarial tactics and enhancing VA’s research capability into adversarial activity and indicators of attack.

(8) Provides the ability to send scheduled request data enrichment, confirmation and validation for emerging possible threats and Incident Response operations/activities.

VirusTotal Professional is the only software that provides all these capabilities in one solution. The CSOC project team estimates if Brand Name VirusTotal Intelligence Software-Professional Bundle is not acquired, acquiring, integrating, and implementing other and individual software solutions would require an additional six month’s planning, increased effort in training, integration of API's with existing tools and reconfigure implemented playbooks, and a minimum estimated increased funding in the amount of

. If VirusTotal Professional is not acquired, VA will be unable to meet increased scanning requirement compliance requirements of BOD 23-01 (Improving Asset Visibility and Vulnerability Detection on Federal Networks).

6. Efforts to Obtain Competition: Market research was conducted, details of which are in section 8 of this justification. This effort did not yield any additional sources that can meet the Government’s requirements. However, the undersigned VA technical representative determined that limited competition is available among authorized resellers for brand name VirusTotal Intelligence Software- Professional Bundle. In accordance with FAR 16.505(a)(4)(iii)(A)(1), this justification will be provided with the solicitation to all appropriate NASA SEWP V GWAC holders. Furthermore, in accordance with FAR 5.301, 16.505(b)(2)(ii)(D), and 16.505(a)(4)(iii), the award notice for this action will be synopsized on the Federal Business Opportunities website and this justification will be made publicly available within 14 days of award.

7. Actions to Increase Competition: In order to remove or overcome barriers to competition on future acquisitions for this requirement, the Government will continue to perform market research to consider and ascertain if there are changes in the marketplace that would allow other brand products to work with the existing infrastructure, thus enabling future actions to be fully competed.

8. Market Research: Market research was conducted June through July of 2023 and February through March 2024 by the CSOC project team. The Government customer team confirmed in July of 2024 that the marketplace for this type of product has not changed since June and July of 2023 and their previous market research remains valid.

The market research included a review of various websites and trade publications and discussions with data managers and researchers in the VA to ascertain if there are other similar software products that can meet the Government’s requirements.

Competitors including the following: Wildfire Malware Analysis, ESET PROTECT Advanced, Intezer Analyze, and Coro Cybersecurity were compared to VirusTotal Intelligence Professional. Based on reviews of the above products, the Government’s technical experts determined that none of these products can fully meet the Government’s requirements as discussed in item 5 above. Additionally, none of these other products combine the several required features as outlined in paragraph 5 into one product as does VirusTotal Intelligence Professional. After additional market research, we found Wildfire Malware Analysis does not offer hash value analysis as is needed for this requirement. ESET PROTECT Advanced appears to be changing to an end-point protections solution, and utilizes VirusTotal (VT) for hash analysis, Intezer Analyze uses VT for hash analysis and requires customer provided VT private key, Coro Cybersecurity does not offer hash value analysis. Review of these products was based on actual VA experience using the competing virus software. Additionally, VA researchers regularly review industry trade publications and conduct internet research to ascertain if any other brand name software is available. Since award of the last contract for VirusTotal Professional Bundle software, VA has determined that there still remains no viable alternative available in the market to replace the existing VirusTotal solution. VirusTotal’s database of reputation results are unmatched compared to other vendors, as well as the multiple vendor results for each file and domain. Additionally, VirusTotal Intelligence Professional licenses were purchased in FY23 via contract NNG15SD27B/36C10B23F0259. Based on these market research efforts, the Government’s technical experts have determined that only VirusTotal Intelligence Professional brand name software can meet all the VA’s needs.

The VirusTotal Intelligence Software- Professional Bundle is commercially available through existing Government contract vehicles, specifically, NASA SEWP. There are 2 Service-Disabled Veteran-owned Small Business (SDVOSB) contract holders of Ivanti products, 1 of which is an authorized reseller. As there are 2 or more identified SDVOSB sources deemed potentially capable of satisfying this requirement under NASA SEWP, this would support an SDVOSB set-aside approach under this vehicle.

The Contract Specialist conducted additional market research by releasing a Request for Information (RFI). RFI #312437 was submitted to all vendors under groups B SDVOSB, B Historically Underutilized Business Zone (HUBZone), C Small Business, D Value Added Resellers, under NAICS code 541519. The RFI resulted with three (3) resellers responding: , a SDVOSB, , a Women-Owned Small Business (WOSB), and , also a WOSB. The pricing of all quotes provided in this RFI suggest pricing will be in line with or slightly beneath the established IGCE of

An email was sent to , the incumbent contractor on the existing contract VA is seeking to replace, to gauge their interest in submitting a quote when the Request for Quotes (RFQ) is eventually released to NASA SEWP. A positive response was received from a representative at , who explained that they would try to submit a quote for the RFI but would certainly submit a quote for the RFQ when it is released. This confirms a second SDVOSB who is capable and interested in submitting a quote for VA’s requirement for the VirusTotal Professional Bundle.

9. Other Facts: None.

10.Technical and Requirements Certification: I certify that the supporting data under my cognizance, which are included in this justification, are accurate and complete to the best of my knowledge and belief.

IT Specialist (INFOSEC), Cybersecurity Operations Center (CSOC)

Date:

Signature

11. Fair and Reasonable Cost Determination: I hereby determine that the anticipated price to the Government for this contract action will be fair and reasonable based on anticipated competition and discounts among NASA SEWP V GWAC holders.

Additionally, NASA SEWP determines that all catalog prices on its GWAC’s are fair and reasonable. Additional price analysis may be performed in accordance with FAR 15.404-1(b).

Date:

Procuring Contracting Officer Signature

12. Procuring Contracting Officer Certification: I certify that this justification is accurate and complete to the best of my knowledge and belief. As this contract action does not exceed $750,000, this document serves as the contracting officer’s basis for using an exception to the fair opportunity process in accordance with FAR 16.505(b)(2)(ii)(A).

Date:

Procuring Contracting Officer Signature: