17_0379_Brand_Name_JUSTIFICATION_REV_3_Redacted.pdf

v1.0_APRIL2016

BACKGROUND:

BRAND NAME SPECIFICATION

Splunk Maintenance renewal and 60GB upgrade 1300605046

The Naval Undersea Warfare Center Division, Newport (NUWCDIVNPT) Code 1041 is required to monitor log files for malicious, unusual, and suspicious activities in accordance with Security Technical Implementation Guides (STIGS) for Red Hat Linux, Windows Server 2008, and Microsoft Structured Query Language (SQL) Server.

During fiscal year 2012 Naval Sea System Command Performance and Compliance Inspection and the Department of Navy (DoN) Cyber Security Inspection (CSI) determined NUWC deficient due to Noncompliance of STIG requirements. Splunk has been evaluated by Space and Naval Warfare Systems Center, Defense Information Systems Agency and DoN and it was concluded that Splunk easily and efficiently meets compliance requirements as identified in relevant STIGs. Splunk is validated and approved by Common Criteria Testing Lab and Navy Information Assurance Partnership. In order to correct this deficiency and maintain compliance according to the aforementioned STIGs, Code 1041 implemented Splunk in fiscal year 2013.

NUWCDIVNPT Code 1041 is using Splunk to captures indexes and correlates real-time data in a searchable repository from which it can generate graphs, reports, alerts, dashboards and visualizations. Code 1041 also uses Splunk for cyber threat detection and intelligence-analysis technology. This requirement is to renew Splunk license support for existing license and add an additional 60 GB to accommodate the log collection for all the devices on all networks in Code 1041, which will increase bandwidth.

Period of Performance: 08/04/2017 - 08/03/2018

Last Contract: N66604-16-P-0626

REQUIREMENT:

The first item listed in table below is the renewal of existing licenses. The second item is maintenance support for the new 60GB licenses and the third item listed is the new 60GB licenses.

Provide parts list (must match quotes):

MFGR Part No Description/Title Qty / SW / Service (Select DADMS NIAP

SE-P-ESUP-R

Splunk Enterprise - Enterprise Support Renewal Existing License 25 GB/day Entitlement = SPL-14137377 PoP: 08/04/2017 - 08/03/2018

Software

91171

SEU-P-ESUP

Splunk Enterprise Upgrade - Enterprise Support

(NEW)

60 GB/day *POP begins on delivery until 8/3/18

SEU-P-LIC

Splunk Enterprise Upgrade - Perpetual License

(NEW)

60 GB/day

Brand Name Specification:

Splunk is a high performance index that takes structured data contained in system log files, security log files, and other system files, and organizes the data into custom query sets. This data allows for the establishment of baseline, trend analysis. Over a period of time provides a window of typical conditions in the following areas: Security and Compliance, Virtualization Management, Operations Management, and Server/Network Management. Splunk allows this data collection, analysis and querying to be done efficiently from a single location with no additional license or deployed products required. In order to meet STIG requirements and remain compliant, NUWCDIVNPT must continue to use Splunk. If NUWCDIVNPT were to transition to a different manufacturer it would cost up to for training, certifications, and labor required to create new processes. In addition, NUWCDIVNPT would not meet current Information Assurance requirements and risk failing the next inspection as well as lose the invested already invested in Splunk environment since 2013.

Product Comparison Matrix:

Requirement/Specification Splunk Microsoft

SCOM

Index Search engine Y N

Does not require a SQL or Oracle Y Y

Database

Provides alerts and a dash board Y Y

Has been implemented within the DoD and the Navy

Y N

RESELLERS:

The required items can be procured directly from the manufacturer, Splunk, or from one of its value-added resellers. There does not need to be an in depth relationship between the vendor and NUWCDIVNPT (Code 1041). We should acquire these items from whichever vendor quotes the best price.

Requiring Department:

Based on the above, I recommend this acquisition be conducted on a Sole Source/Brand Name Specification basis. I certify the technical data which form the basis of this justification are complete and accurate.

APPROVAL:

Contracting Department:

Based on the above, I have determined that the circumstances of the contract action deem only one brand name that will meet the requirement. I certify that this justification is accurate and complete to the best of my knowledge and belief.

03/10/2017