REDACTED Brand Name Justification and Approval -under-SAT - theHive.pdf

Control No:

CUI

Memorandum for Record – Limiting Competition at or below the Simplified

Acquisition Threshold Brand Name Justification

1. Contracting Activity: U.S. Army Contracting Command, Aberdeen Proving Ground(ACC-APG) Huachuca Division ATTN: CCAP-CCH 2133 Cushing Street, Building 61801 Fort Huachuca, Arizona 85613-7001 .

2. Description of Action: The 5th Signal Command located in Germany is requesting a brand named firm fixed price purchase order to procure software named The Hive.

This purchase order will be utilizing Fiscal Year (FY) 2023 funding which consists of Operations & Maintenance, Army (OMA) funding.

The Hive software will need to be procured for one (1) year Gold Licenses for one (1) organization and 20 users.

3. Description of Services or Supplies: As the Tier II Cybersecurity Service Providers (CSSP), U.S. Army Cyber Command (ARCYBER) administers and controls operations for the Gabriel Nimbus Rally case management solution utilized by all Regional Cyber Centers and other CSSPs across the globe, including RCC-E. In late 2021, DCOD successfully integrated TheHive (version 4) case management solution data with Rally on both the NIPR and SIPR networks; providing updated incident reporting information. Furthermore, RCC-E remains a prime contributor of data sharing within the U.S. Army Big Data Platform (BDP). Using TheHive, RCC-Europe DCOD maintains fully automated integration with the European ITSM instance to generate trouble tickets and share incident response guidance with theater subscribers.

DCOD designed TheHive to meet European theater and Gabriel Nimbus requirements and continues to develop and improve features/contributions to both. At the time of writing justification for Hive5, RCC-E DCOD received positive feedback for Rally inputs from ARCYBER F&MA, NETCOM G26, CONUS-based intelligence personnel (66th MI), and other LE/CI related entities.

Period of Performance: 1 September 2023 to 30 August 2024 Total Value:

4. Authority: FAR 13.106-1(b)(1): For purchases not exceeding the simplified acquisition threshold (SAT), only one source reasonably available, urgency, exclusive licensing agreements, brand name, or industrial mobilization.

5. Reasons for Authority Cited: Support for the open source/free version 4 of TheHive that the RCC-E uses ended at the end of calendar year 2022. RCC-E invested over four years of development and is currently operating on TheHive version 4 to support the USAREUR-AF Defensive Cyberspace Operations (DCO) mission. RCC-E requires TheHive version 5 to modernize and support continued Security Orchestration, Automation, and Response (SOAR) advancements developed over the previous three years. TheHive 5 is a paid version of the case management and SOAR platform, and if implemented, immediately improves mission capabilities conducted by Defensive Cyberspace Operations Division (DCOD) within RCC-E. RCC-E conducts incident and tasking order case management within TheHive to support real-time analysis and reporting for U.S. Army Europe and Africa (USAREUR-AF), providing subscribers with on-demand incident/threat response information and guidance. The theater solution is integrated with tools currently utilized by theater incident responders, intelligence personnel, and decision makers. Using TheHive, DCOD developers created conditions of automation enjoyed by all parties involved.

6. Publicizing Contract Actions: For FAR Part 13 actions, Action is a brand name restriction, over $25K. It will be redacted and posted with the solicitation.

7. Market Research: Market analysis conducted by obtaining an Immix Technology pricing. TheHive has no vendors selling through CHESS.

8. Other Facts: TheHive also automates a subsequent e-mail notification function to apprise theater cybersecurity personnel of pending response actions or requirements outside of the assigned organization. The automations related to externally required incident response actions allow RCC-E DCOD personnel to focus on analysis and data collection efforts in lieu of manual remediation request preparations.

DCOD designed TheHive to meet European theater and Gabriel Nimbus requirements and continues to develop and improve features/contributions to both. At the time of writing justification for Hive5, RCC-E DCOD received positive feedback for Rally inputs from ARCYBER F&MA, NETCOM G26, CONUS-based intelligence personnel (66th MI), and other LE/CI related entities.

Migration to a supported Hive5 instance will provide enhanced SOAR features through the incorporation and automation of Cortex, MISP, and other free open-source integrations. Using DCOD Hive5 and related integrations will enhance operations involving phishing e-mail analysis, cyber threat emulation (attack replay), threat intelligence collection, detection engineering, and many other DCO-related capabilities.

9. Technical/Requirements Certification: I certify that the supporting data under my cognizance which are included in the justification are accurate and complete to the best of my knowledge and belief.

10. Contracting Officer Certification/Approval: I hereby determine that the anticipated cost or price to the Government for this contract action will be fair and reasonable based upon price analysis. I certify that this justification is accurate and complete to the best of my knowledge and belief, and that completing this purchase as a sole source is in the best interest of the Government. Additionally, I approve this justification to limit competition subject to the availability of funds and provided that the services or supplies herein described have otherwise been authorized for acquisition.