RFI-Attachment 1-User Activity Monitoring and Behavioral Analytics Solution.pdf

AƩachment 1

Part 1: Compliance and enclave compaƟbility

1.1 Compliance and cerƟficaƟons

Describe your soluƟon's alignment with the following federal compliance frameworks and cerƟficaƟons. Please provide supporƟng documentaƟon and cerƟficaƟon levels.

EO 13587, EO 14028

CNSSD 504

NIST SP 800-53 Rev. 5

ICD 503

FIPS 140-2 validated cryptographic modules FedRAMP Moderate or High cerƟficaƟon (for cloud-hosted components) RMF accreditaƟon support

1.2 Session capture- Must capture a wide range of behavioral telemetry, including web acƟvity, email, chat, file access, applicaƟon usage, and keyboard usage and a full-context replay of user sessions, like a "DVR-style" video capture, to aid forensic invesƟgaƟons.

Describe the soluƟon's session capture capabiliƟes.

Does the soluƟon provide DVR-style, full-color video capture of user sessions?

Can recording be triggered by policies (e.g., specific user acƟons, file access), and does it include pre- and post-event context?

Describe if session capture is determinisƟc and independent of User and EnƟty Behavior

AnalyƟcs (UEBA) or ArƟficial Intelligence/Machine Learning (AI/ML)?

Does the soluƟon provide tamper-evident video and metadata with cryptographic integrity?

Describe playback features, including Ɵmeline navigaƟon, tagging, and annotaƟon.

1.3 Forensic and invesƟgaƟve tools- The soluƟon must implement robust encrypƟon protocols in accordance with ExecuƟve Order 14028.

Specifically:

EncrypƟon in Transit: All data transmiƩed between endpoints, agents, servers, and storage systems must be encrypted using FIPS 140-2 validated cryptographic modules.

TLS 1.2 or higher is required for all communicaƟons.

EncrypƟon at Rest: All stored data, including video captures, metadata, logs, and configuraƟon files, must be encrypted using AES-256 or equivalent FIPS 140-2 validated encrypƟon standards. In addiƟon to monitoring and analyzing external system logs, the soluƟon must provide comprehensive logging of its own applicaƟon behavior, including but not limited to:

o AdministraƟve acƟons (e.g., policy changes, user access, configuraƟon updates) o System events (e.g., service restarts, failures, updates) o Audit trails of all user interacƟons with the user interface o Access and modificaƟon of captured data or forensic arƟfacts

These logs must be tamper-evident and immutable, cryptographically signed, and Ɵmestamped, exportable for external audit and compliance review, stored securely with the same encrypƟon standards as captured user acƟvity, Describe the features available for forensic analysis and invesƟgaƟons.

What export capabiliƟes are available, and how is the chain of custody for evidence maintained?

Are logs and metadata immutable?

Describe the invesƟgator interface, including funcƟonality for replay controls, tagging, and workflow management.

How are exported arƟfacts hashed for forensic integrity?

1.4 Data sensiƟvity controls- Provide granular policy controls to define what informaƟon is collected, including the ability to block or minimize the collecƟon of sensiƟve data such as passwords and PII.

Describe how the soluƟon handles sensiƟve data.

Does the soluƟon support policy-driven data minimizaƟon?

Can the soluƟon block or capture specific data types (e.g., passwords, PII, classified/sensiƟve data)?

How is a "Do Not Collect" policy enforced?

Can collecƟon policies be defined based on user roles?

Does the soluƟon offer masking or anonymizaƟon of PII based on policy?

1.5 Policy engine

Describe the capabiliƟes of the policy engine.

Does the engine support compound condiƟon statements?

Does it support nested logic (please specify the minimum number of layers)?

Does it require mulƟ-personnel authorizaƟon for policy creaƟon and ediƟng?

Can user-level policies be created, edited, and deleted?

1.6 Endpoint agent- A lightweight, policy-driven endpoint agent that integrates the following enterprise tools and plaƞorms (Splunk, Jira) and exisƟng Data Loss PrevenƟon (DLP) soluƟons (e.g. CrowdStrike, Guardian, MicrosoŌ Defender, FireEye, etc.) and be capable of robust data collecƟon with minimal impact on system performance. The agent must collect acƟvity data persistently, even when a device is offline.

Describe the endpoint agent specificaƟons.

What is the agent's footprint (system/network impact)?

Does the agent have a persistent offline collecƟon capability?

How is all monitored acƟvity cryptographically bound to an authenƟcated user idenƟty?

Does the soluƟon support PKI cerƟficates and PIV cards?

Does the idenƟty binding persist across online, offline, and air-gapped modes?

1.7 UEBA

Describe UEBA’s configurable risk scoring and behavioral models to detect nuanced acƟviƟes (e.g., data staging, lateral movement, unusual communicaƟon paƩerns) using UAM data.

How does UEBA ensure transparency and explainability in alerts and risk scores (not “black-box” models)?

Does the soluƟon permit user level determinisƟc policy thresholds in addiƟon to learned behavioral models?

How does the soluƟon ensure linkage of behavioral anomalies to specific events, Ɵmelines, and user idenƟƟes in a tamper-evident manner?

Do UEBA policies support deterministic thresholds alongside learned behavioral models?

How does UEBA monitor non-user entities (e.g., devices, network flows)?

Does it support automated data feeds and/or exports of raw and enriched behavioral data, based on use case, to organizational data lakes regardless of the target operating environment (on-premises or cloud environments)?

1.8 Independent baseline monitoring

Do UAM and UEBA require AI/ML for baseline activity monitoring, or can they perform deterministic capture, storage, and replay (UAM) and anomaly detection (UEBA) independently?

Confirm UEBA’s standalone anomaly detection and baselining without UAM reliance.

Confirm UAM’s standalone functionality and baselining without UEBA reliance.

Confirm UAM interconnectedness with UEBA functionality Confirm UEBA interconnectedness with UAM functionality Confirm the ability to perform UAM determinisƟc capture, storage, and replay funcƟonality without AI/ML.

1.9 Governance and oversight

Describe the vendor's foreign nexus, if applicable. The Government requires U.S.-based development, support, and data handling.

Does the soluƟon provide a "Watch the Watcher" capability to audit soŌware users?

Are audit logs tamper-proof?

Does the soluƟon provide a centralized, secure workbench for analysts to triage, collaborate on, UAM generated alerts?

Does the soluƟon provide an analyƟc sandbox for UEBA?

Describe the role-based access control (RBAC) for administraƟve funcƟons and how it ensures the integrity of case records with built-in chain-of-custody tracking

1.10 Disaster recovery and data retenƟon- The system must support configurable roll-off Ɵmeframes for data archiving. Administrators should be able to adjust the online retenƟon period through a simple configuraƟon change, prompƟng the system to automaƟcally iniƟate the roll-off process. If the retenƟon period is extended, the system should be capable of reintegraƟng archived data into the acƟve set, subject to available storage capacity

Describe how the soluƟon supports the following:

o Recovery Time ObjecƟve (RTO): ≤ 72 hours o Recovery Point ObjecƟve (RPO): ≤ 24 hours o RetenƟon period: ≥ 25 years

Describe your daily backup and archival strategy, including the handling of "roll off files" for data retenƟon beyond the acƟve database period.

How is aged data archived to low-cost object storage?

What is your approach to avoiding standby database licensing costs?

1.11 Enclave compaƟbility

Will the vendor support custom workstaƟon image tesƟng?

Can the soluƟon ensure compaƟbility with enclave-specific policy restricƟons?

Will the vendor validate agent and soŌware behavior in controlled enclave environments?

Part 2: AWS cloud compaƟbility

2.1 General AWS compaƟbility

Does the soluƟon fully support AWS GovCloud and standard AWS regions?

Describe the integraƟon with AWS-naƟve services, including:

o AWS CloudTrail o AWS IAM o AWS KMS

How is data encrypted at rest and in transit within the AWS environment?

Describe support for AWS IdenƟty FederaƟon and RBAC.

2.2 Scalability and deployment

How does the soluƟon support scalable deployment across AWS EC2, EKS, and Lambda?

2.3 Regional redundancy

Can the primary instance be deployed in a single AWS region?

Does the soluƟon support the "spin-up" of a secondary instance in an alternate AWS region on-demand?

Does the disaster recovery model avoid the need for a licensed standby database instance?

Part 3: Database requirements

3.1 Database support

Does the soluƟon provide naƟve support for PostgreSQL and ElasƟcSearch?

Does the soluƟon rely on Oracle RDBMS? If so, what is the plan to replace this funcƟonality with ElasƟcSearch?

How are all features validated for both PostgreSQL and ElasƟcSearch deployments?

Part 4: Deployment flexibility

4.1 Deployment models

Confirm support for the following deployment models:

o Cloud (AWS preferred) o On-premises infrastructure o Classified and air-gapped environments

Does the vendor offer TS/SCI on-site support capability?