JEFO - Splunk_Redacted.pdf

Justification for Brand Name Exceeding the SAT pursuant to FAR 16.505(a)(4)

JEFO No.: FY24-00241

Date: September 25, 2024 PR Number: PCCS-24-30007

1. Agency and Contracting Activity. Identification of the agency and the contracting activity, and specific identification of the document as a “Justification for Brand Name.”

The Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), Chief of Contracting Office (COCO), prepared this Justification for Brand Name on behalf of CISA's Cybersecurity Division (CSD) Threat Hunting (TH) Capabilities, Data, and Integration (CDI) branch.

2. Nature and/or description of the action being approved.

DHS CISA COCO intends to award a competitive delivery order for the purchase of Splunk Enterprise (Splunk) licenses without considering other software brands, pursuant to FAR 16.505(a)(4), restricting consideration to an item peculiar to one manufacturer (brand-name specific).

3. A description of the supplies or services required to meet the agency’s need (including the estimated value).

DHS CISA requires Splunk Enterprise Licenses for hunt and incident response field kits, lab environment, and for testing, development, and training purposes. The procurement will include the following Splunk licenses:

Description Manufacturer

Part Number Required QTY

CLIN 1 Splunk Enterprise - Unlimited Adoption Term License with Standard Success Plan - Gigabyte (GB)/Day

SE-T-LIC-UA-ST 15

CLIN 2 Splunk Enterprise (CORE) - Term License with Standard Success Plan - 500 GB/day

SE-T-LIC-ST 1

CLIN 3 (OPTIONAL) Splunk Enterprise Security (ES) - Term License with Standard Success Plan -500 GB/Day

ES-T-LIC-ST 1

CLIN 4 (OPTIONAL) Splunk Soar - Term User Seat License with Standard Support - 5 User Seats

PH-T-LIC-U-ST 1

Period of Performance (POP) is a 12-month period, September 30, 2024, to September 29, 2025. The total estimated value is $

4. Identify the Brand Name and supporting rationale.

CISA/COCO intends to procure Splunk Enterprise licenses under a brand name specification in accordance with FAR 16.505(a)(4)(i). The exception is based on FAR 16.505(a)(4)(i), the brand-name, product, or feature is essential to the Government’s requirements and market research indicates other companies’ similar products, or products lacking the feature, do not meet, or cannot be modified to meet, the agency’s needs.

CDI requires an incident response platform to support on-site “fly-away” teams when called to assist with incident response investigations. An engagement kit, also referred to as a customized “field kit” or “fly away kit,” is a collection of network taps, servers, and storage arrays, along with supplemental equipment used for hunt and incident response activities at a customer’s location. These kits are designed and built in-house and are based on CDI’s unique requirements to be provisioned and deployed into networks of disparate sizes, to collect an array of data at various capture rates, and to sanitize customer information from the kits after each engagement.

The brand name must be used because Splunk possesses essential features that other products either lack or cannot be modified to meet the agency’s needs. Splunk’s adaptability makes it an invaluable tool for discovering and analyzing malicious cyber activity. CDI conducted a comprehensive evaluation of eleven Endpoint Detection and Response (EDR) tools, including both commercial off-the-shelf (COTS) and open-source options, selected to meet government requirements. These tools, described below, were rigorously assessed against nearly 300 criteria, focusing on integration with the current field kit technology stack and interoperability. The summary of CDI’s findings is as follows:

CrowdStrike Falcon: CrowdStrike Falcon focuses heavily on endpoint protection and detection with built-in machine learning. While it excels in real-time detection and response, it lacks the robust data aggregation and analytics capabilities offered by Splunk.

Carbon Black (VMware Carbon Black): Carbon Black provides strong endpoint visibility and response capabilities but does not offer the necessary additional tools for comprehensive data aggregation and analytics comparable to Splunk.

Symantec Endpoint Detection and Response (EDR): Symantec EDR provides good endpoint security features but lacks the extensive capabilities in data analytics and real-time monitoring that Splunk offers.

Trend Micro Apex One (formerly Trend Micro OfficeScan): Trend Micro Apex One focuses on endpoint security but does not offer Splunk's level of capability in data aggregation, analytics, and scalability.

FireEye Endpoint Security: FireEye Endpoint Security is strong in threat detection but lacks specialization compared to Splunk, which provides broader capabilities in data aggregation and analysis.

Cisco Secure Endpoint (formerly AMP for Endpoints): Cisco Secure Endpoint provides robust endpoint protection but does not offer data aggregation and analytics capabilities similar found in Splunk's comprehensive platform.

McAfee Endpoint Security: McAfee Endpoint Security provides solid endpoint protection but does not deliver the capabilities as Splunk in terms of data aggregation, analytics, and scalability.

Palo Alto Networks Cortex XDR: Palo Alto Networks Cortex XDR offers integration with their broader security ecosystem but lacks the capabilities that differentiate it in terms of data aggregation and analytics compared to Splunk.

SentinelOne: SentinelOne focuses on endpoint protection and does not offer the breadth of data aggregation and analytics capabilities that Splunk does.

Bitdefender GravityZone: Bitdefender GravityZone offers strong endpoint security features but lacks Splunk's extensive capabilities in data analytics and real-time monitoring.

Kaspersky Endpoint Security: Kaspersky Endpoint Security provides solid endpoint protection but lacks the data aggregation, analytics, and scalability capabilities that Splunk offers.

Splunk offers a unified platform that provides comprehensive visibility, analysis, and response capabilities across their entire IT environment. Splunk has consistently demonstrated its value in detecting and analyzing malicious cyber activities across multiple CDI engagements. Splunk offers unique capabilities such as:

Data Aggregation and Analytics, where Splunk excels in aggregating and centralizing data from diverse sources beyond just endpoints, leveraging its powerful analytics capabilities with Splunk Processing Language (SPL), Scalability: Splunk is highly scalable, capable of managing large volumes of data across distributed environments, which is crucial for enterprise-level deployments, Integration and Flexibility: Splunk supports extensive integration with third-party tools and systems, providing flexibility to adapt to specific organizational needs and workflows, Real-time Monitoring and Alerting: Splunk offers capabilities for real-time monitoring and alerting, enabling proactive detection and response to security incidents, and

Compliance and Reporting: Splunk offers robust capabilities for compliance monitoring and reporting, which are essential for industries with strict regulatory requirements.

These capabilities make Splunk an essential tool, especially in CDI field kits, thanks to its adaptability, advanced threat intelligence, robust detection capabilities, and reliable services in threat hunting and incident response.

Furthermore, Splunk is a Technology Referenced Model (TRM)-approved tool and a vital component of CDI's customized field kits, serving as the central platform and dashboard for data inputs. Altering the field kit configuration would necessitate equipment reconfiguration and approval from the Change Control Board. Using alternative products could lead to interoperability, compatibility, or interface issues that hinder the support team's ability to provide efficient and effective operations support. Additionally, adopting another tool would