U.S. Department of Justice (DOJ) Office of Acquisition Management (OAM)

Request for Information (RFI) for:

Software as a Service (SaaS) log management / Security Information and Event Management (SIEM)

July 2026 For Official Use Only | Procurement Sensitive 1

THIS IS A SOURCES SOUGHT ANNOUNCEMENT FOR INFORMATION AND

PLANNING PURPOSES ONLY. THIS IS NOT A SOLICITATION FOR PROPOSALS AND

NO CONTRACT WILL BE AWARDED FROM THIS ANNOUNCEMENT.

This Request for Information’s (RFI) specific purpose is to obtain market information on viable sources, industry best practices, innovative technical approaches/solutions, potential costs, estimated timeframe for execution, and answers to specific questions.

Interested parties are advised that the government will NOT pay for any information or administrative costs incurred in response to this RFI; all costs associated with responding to this RFI will be solely at the interested party's expense. Not responding to this RFI does not preclude participation in any future solicitation, if issued. It is the responsibility of the interested parties to remain current on information pertaining to this requirement.

The information provided in this RFI is subject to change and is not binding to the government.

No commitment is being made to procure any of the services discussed, and release of this RFI should not be construed as a commitment or authorization to incur cost for which reimbursement would be required or sought.

All submissions will become the property of the Government and will not be returned.

Proprietary information, if any, must be clearly marked on all material(s) submitted. All information received marked Proprietary will be handled in accordance with 41 USC 2101-2107.

Purpose:

The Department of Justice’s (DOJ) Justice Management Division (JMD) is seeking a Federal Risk and Authorization Management Program (FedRAMP) Moderate, High-Ready and/or High Software as a Service (SaaS) log management / Security Information and Event Management (SIEM) solution to bridge the gap between the Department’s current log ingestion/retention competency and Office of Management and Budget (OMB) Memorandum M-26-14, Ensuring Effective and Efficient Agency Logging and Network Visibility to Defend Against Evolving Cyber Threats, mandated capabilities while retaining all of the DOJ’s log aggregation requirements.

This solution will replace the DOJ’s current, on-premises log management / SIEM solution which is not best suited to meet the requirements of Office of Management and Budget (OMB) Memorandum (M) (M-26-14). Market research has identified that commercial solutions are available to meet the government’s need for an information technology (IT) solution that is compatible with its current network and other existing Department systems (e.g., Windows, Linux, network devices, endpoint detection and response tools, application logs, operational technology, etc.) as well as M-26-14 mandated requirements. The SIEM must assist with response actions to mitigate issues that:

• Cause harm to the organization Information Technology (IT), network enclave, system platforms, application use, and endpoints

July 2026 For Official Use Only | Procurement Sensitive 2

• Satisfy compliance by National Institute of Standards and Technology (NIST), U.S.

Department of Homeland Security (DHS), Cybersecurity and Infrastructure Security Agency (CISA), DOJ/Office of the Inspector General (OIG), DOJ/Justice Management Division (JMD), and audit requirements that include Federal Information Security Modernization Act (FISMA), Federal Risk and Authorization Management Program (FedRAMP), Executive Orders (EO) and

• Respond to data calls and reporting requirements that concern stakeholders.

Background:

JMD Cybersecurity Services Staff (CSS) provides an enterprise service that performs log management / SIEM support for the Justice Security Operations Center (JSOC), DOJ Components, and other Federal Agencies. This service is called Logging-as-a-Service (LaaS) and supports near real-time security monitoring, empowering staff as they investigate, monitor, analyze, and respond to security incidents. Furthermore, LaaS supports advanced threat detection and response, digital forensics, and incident management in support of DOJ risk management decisions.

Performance Objectives/Required Results The Department is seeking information regarding a log management / SIEM solution from a single vendor that enables cybersecurity operations and supports meeting M-26-14 requirements.

The vendor must provide a complete solution which meets all the requirements set forth in this RFI without third party solutions or future development to meet the current requirements.

Scope:

Generic and Solution-Specific Objectives and Tasks

• The Vendor shall provide a configurable log management / SIEM solution that meets

DOJ’s operational and M-26-14 requirements, detailed below.

• The Vendor shall provide professional services to provide insight into the solution management, recommendations, and consulting on the migration on the DOJ’s current, on-prem solution to the Vendor’s Software as a Service (SaaS) solution.

• The offered single-vendor solution provided must be a cloud-based SaaS service, and it is required to have a categorization of High FedRAMP Authorization to Operate (ATO).

• Given the sensitive nature of the data, encryption of data at rest and in transit is required to meet Department and Federal data encryption policies and requirements.

• The Vendor shall provide technical documentation for the configuration and general support for the system.

• The Vendor shall offer single-vendor solution training courses necessary for administration and management of the service/solution.

• The Vendor provides user friendly task and workflow automation in support of implementing automation of security operations.

July 2026 For Official Use Only | Procurement Sensitive 3

• The Vendor should not require any third-party software for the system to perform normal operations and functionalities to include storage.

• Provide a single-vendor solution that allows the DOJ to have control and/or approval prior to any system upgrades or enhancements that change user experience, system capability, or system performance.

• The Vendor shall provide Service-level Agreements (SLAs): availability, performance (e.g., search times, ingest speed, etc.), increase in capacity, continuity, support response, cybersecurity incident response, changes, and releases, etc.

Ingestion / Search

• Provide the ability to forward or pull or otherwise capture security, operational, network, and application-related data (real-time and historical auditable, actionable, and investigable events) and the like from any network attached endpoints (including but not limited to servers, workstations, operating systems, firewalls, antivirus software, intrusion prevention systems, SaaS solutions, vulnerability scanners, other hardware, software and network devices).

• Provide the ability to permanently store (ingest) real-time and historical auditable, actionable and investigable events into a searchable repository.

• Provide the ability to search, generate reports, display real-time, historical auditable, actionable and investigable events from the searchable repository, using a Natural Language, Structured Query Language, Entity-Centric, Timeline-Based Investigation, Federated, Risk-Based, Artificial Intelligence (AI) Augmented, and or Wildcard search term method which does not require a user to know a specific language field names nor values.

• Provide the ability to ingest, collect, forward, pull, acquire or otherwise capture data from diverse sources including Internet of Things (IoT) devices and Operational technology (OT) that do not have native logging capability.

o Ability to manage and adjust logging configuration settings, onboard new log requirements, and modify log collection parameters at tenant levels.

• Provide support for data ingestion method beyond flat log files residing on an endpoint/asset (including but not limited to direct database connections and/or Application Programming Interface (API) sources, etc.).

• Provide data collection agents and data forwarding and ingestion mechanisms that account for data collection checkpoints, buffering at source, buffering at destination, and load balancing capabilities to account for any partial or total outages during the data collection process.

• Provide data collection agents and data forwarding and ingestion mechanisms that will incorporate indefinite retry logic in order to backfill in the event of log collection disruption to eliminate logging gaps.

• Provide the ability to categorize events based on raw data and apply custom correlation or normalization rules to combine individual events.

July 2026 For Official Use Only | Procurement Sensitive 4

• Provide built-in methods for correlation and normalization of data as well as allow for the development of custom methods for correlation and normalization.

• Provide the ability to search for data in real-time or near-real-time (immediately upon receipt of data from source) in any fashion.

• Provide the ability (through apps, add-ons, plugins, integrations, etc.) for the Vendor’s solution and/or data source vendors to provide pre-configured parsing and/or field extraction rules for data sources.

• Provide a single-vendor solution that has the ability to query Representational State Transfer (REST) API endpoints with a variety of security mechanisms in place including but not limited to certificate authentication.

• Provide ability to query indexed data within alternate SIEM solution (Splunk)and or ability to ingest data from Splunk to support visibility into historical data SIEM coexistence phase during migration activities.

• Adjust/format timestamps and other fields (at ingest or search time).

• Provide a single-vendor solution that allows for encryption of data in transit and data at rest and hash it regularly for veracity.

• Provide the ability to display output from calls to third party Application Programming

Interface (APIs) without requiring ingestion of returned data.

• Provide a single-vendor solution that allows for comprehensive visibility, collection, and logging of activity in non-persistent Virtual Desktop Infrastructure (VDI) environments.

• Provide a single-vendor solution that supports non-event data (e.g. NetFlow, vulnerability data) being used in correlation rules.

• Provide a single-vendor solution that supports event normalization from multiple sources and enrichment such as Internet Protocol (IP) address resolution, geolocation, etc while preserving the integrity of the raw log.

• Provide a single-vendor solution that can ingest/normalize custom logs from diverse log sources (syslog, database, extensible markup language/multi-line, and logs from OT/IoT devices).

• Provide a single-vendor solution that has user session tracking capabilities (auto mapping user-device relationship, use of super user/admin accounts, etc.).

• Provide a single-vendor solution that supports custom correlation rule authoring.

• Provide a single-vendor solution that supports threat intelligence feeds, native and/or 3rd party (e.g. Structure Threat Information Expression (STIX), Trusted Automated Exchange of Intelligence Information (TAXII), Yet Another Recursive Acronym (YARA), JavaScript Object Notation (JSON) and other Threat Intelligence platforms).

• Provide a single-vendor solution that natively supports detection of advanced threats (e.g., supports integration with Endpoint Detection and Response (EDR), Enterprise Endpoint Management, Network Traffic Analysis, and the ability to monitor, analyze, and detect threats in payloads).

July 2026 For Official Use Only | Procurement Sensitive 5

• Provide a single-vendor solution that provides situational awareness, contextual and actionable information through correlation, data enrichment, intelligence, MITRE ATT&CK mapping, and analytics against all data sources.

• Provide the ability to selectively ingest specific attributes/fields within a log event while forwarding the raw log to alternate destination such as a separate storage location.

• Provide a single-vendor solution that can create routes to pipe event data flow (back and forth) with other third party SIEM solutions, which in turn requires support for multiple-format event management capability.

• Provide a single-vendor solution that can evaluate incoming events against predefined filtered expressions to find the appropriate route to for delivery.

• Provide a single-vendor solution that can evaluate routing of events in a predefined order.

• Provide the ability to selectively mask or obfuscate DOJ defined portions of log events.

• Provide a single-vendor solution that supports ingestion and searching of IPv4 and IPv6 addresses.

• The ability to tag log sources as Continuous Event Monitoring (CEM) or Threat Hunting, Investigation, Response, and Forensics (THIRF) as defined in M-26-14.

Reporting / Alerts / Integration

• Provide the ability to generate tabulated reports from events.

• Provide the ability to generate graphs and charts from events.

• Provide the ability to generate clear and custom dashboards and visualizations.

o Provide the ability to drill down from content (e.g. reports or graphs or dashboards) to the raw individual events which power that content.

• Provide reporting on M-26-14 Appendix C Maturity Levels.

• Provide the ability to drill down from content (e.g. reports or graphs or dashboards) to the raw individual event data which powered that content.

• Provide automatic notifications based on events - via alerts, dashboards, and integrations

(to include events internal to the solution).

• Provide a mechanism (either built-in or by allowing custom development) for transmission of data to/from other enterprise systems for the purpose of automation and orchestration.

• Provide a mechanism (either built-in or by allowing custom development) for user interactivity from a dashboard which performs actions in other enterprise systems (i.e.

executing API calls at the click of a button).

• Provide a single-vendor solution which can be customized for customer-specific interfaces and functionalities (using front-end methods such as JavaScript, HyperText Markup Language (HTML), Cascading Style Sheets (CSS), Extensible Markup Language (XML), etc. and/or back-end methods such as Python, PowerShell, Shell scripting, etc.).

• Provide a single-vendor solution with its own Representational State Transfer Application Programming Interface (REST API) to which it can be added to custom

July 2026 For Official Use Only | Procurement Sensitive 6 endpoints for customer-specific functionalities and support DOJ management of the solution.

• Provide a single-vendor solution with the ability to enrich ingested data with customer-provided (e.g. lookups for asset lists, external API/webhook calls for details such as "who is", and tags for context such as VIPs, admin accounts, etc.) and third-party provided (e.g.

VirusTotal, MaxMind, Anomali) data.

• Provide a single-vendor solution that alerts when components are not configured to generate audit log events as required and when feeds from devices are lost.

• Provide a single-vendor solution that can post results in external solutions via webhooks.

• Provide the ability to store, manipulate or retrieve information in data tables (e.g. comma-separated values (CSV) lookup) with the ability to import and export the data tables into and from the solution as well as the ability to leverage the data within a search and make updates to the table based on query output.

• Provide a single-vendor solution to trigger alert workflows for log ingestion disruptions (i.e. server stop checking in).

• Provide a single-vendor solution that can develop custom applications for individual system reporting and alerts.

• Provide a single-vendor solution that enables automated remediation and mitigation (e.g.

security operations, patch, or configuration management tools).

• Provide a single-vendor solution that can integrate with service desk platforms and problem management single-vendor solutions.

• Provide a single-vendor solution with highly customizable reporting capabilities (format, content, timeframe, etc.) from ad hoc and pre-defined queries, in support of regulations or guidance, control standards, etc.

• Provide a single-vendor solution that utilizes contextual data from security assessment technologies such as vulnerability, security configuration or application security assessments.

• Provide a single-vendor solution with support for business and organizational context (e.g. import from Configuration Management Database (CMDB), Hardware Asset Management (HWAM), Software Assessment Management (SWAM), etc.).

• Provide a single-vendor solution that includes file integrity monitoring (FIM) that periodically checks against log hashes.

• Provide a single-vendor solution that integrates with Identity Access Management (IAM) products, enterprise directories, or applications (such as Web Access Management (WAM)) to enable identity and access related policies for monitoring changes (user or group permission changes, file or directory permission changes).

• Provide a single-vendor solution with incident/case management capability including the ability to support investigations, create and implement workflows, automate response actions, track response times, report development (out-of-the-box and custom), etc.

July 2026 For Official Use Only | Procurement Sensitive 7

Storage / Architecture

• Provide the ability to retain searchable data for at least six (6) months with an additional six (6) months in cold storage and/or in accordance with Government mandates (i.e.

OMB M-26-14).

• Provide scalability for high log volumes to ingest up to 60TB plus of data daily

• Provide a high-availability single-vendor solution which allows data availability, ingestion and searchability despite outage(s).

• Provide a single-vendor solution priced in a tiered model.

• Provide a single-vendor solution which functions as a SaaS.

• Provide a single-vendor solution with the capability of supporting multiple role-based accessed tenants with segregated data and segregated content per tenant that is visible by a parent tenant.

o Isolation of multiple cloud accounts within shared boundaries.

• The vendor shall provide a single-vendor solution with the ability to centrally manage any necessary endpoint data collection agents to include ability to update agents and provide the ability for DOJ administrators to deploy and manage data collection configurations on the agent.

• Provide a single-vendor solution which stores data in (1) a fast-searchable (i.e. "hot") high-speed repository, (2) a less-fast-searchable (i.e. "cold”) less-expensive repository and (3) archive (i.e. “frozen”) repository.

• Provide a single-vendor solution that allows hierarchical organizational role-based access wherein an administrator can have access to all data within the environment and users are restricted to specific subsets of data and content.

• Provide a single-vendor solution with flexible retention policies wherein retention can be set in various ways (such as per-index and/or per-source and/or per-customer) and wherein retention can be set for any customer-determined length of time, including permanently.

• Provide a single-vendor solution with the ability to cluster individual ingest-layer servers and individual search-layer servers (e.g. for high availability, disaster recovery and failover, user load balancing, etc.).

• Provide a single-vendor solution with native integration/plug-in capability for zero trust providers.

• Provide a single-vendor solution wherein licenses and/or usage fees may be purchased by a managed service provider on behalf of that provider's customers and/or tenants.

• Provide a single-vendor solution with native integration/plug-in capability for Privilege Access Manager Solutions.

• Provide a single-vendor solution that supports highly distributed environments.

• Provide a single-vendor solution that works with other 3rd party log management solutions via standards like syslog.

July 2026 For Official Use Only | Procurement Sensitive 8

• Provide a single-vendor solution that supports northbound APIs for connecting to cloud services, security technologies (firewalls, Intrusion Detection and Prevention System (IDPS), etc.), ticketing systems, etc.

• Provide a single-vendor solution that supports inbound APIs that can be used for search, extract, manage, or configure (ticketing or orchestration to pull data from SIEM, orchestration tool to add admins to the SIEM).

• Provide a single-vendor solution that will provide a non-production environment for testing. The non-production environment shall allow developers to mimic the characteristics of the production environment and create simulated responses.

Search Performance

• The vendor log management system search performance must be capable of searching through millions of structured (indexed) and unstructured (raw) log messages in less than a minute without impacting other scheduled searches or user experience.

o Deliver fast search and analytics performance, including real-time alerts.

• The vendor shall provide a query performance service level agreement.

Search Concurrency / Limitations

• Provide the ability to execute a minimum of 120,000 scheduled searches in 5 minutes intervals across a searchable six (6) plus months of data for a 60TB/day dataset without performance impact to ad-hoc searches, data ingestion pipelines, and other users/customers experience.

• Provide the ability to execute 2000 searches of six (6) plus months' worth of logs at a minimum of 60TB/day simultaneously without impacts to customer experience.

• Provide the ability to do real time searches which that include updated results based on data being ingested.

• Provide administrators the ability to control the number of concurrent and scheduled searches that can be run by role and or by individual user.

• Provide the ability to accelerate or cache normalized data models for rapid search response.

• Provide the ability to limit user-based and/or role-based search concurrency.

• Provide the ability to monitor user searches for performance.

• Provide the ability to search data in a real-time or near-real-time (immediately upon receipt of data from source) fashion.

• Provide a solution that allows for comprehensive visibility, collection, and logging of activity in non-persistent VDI environments.

Accreditation / Security

• Provide a single-vendor solution accredited at the FedRAMP FedRAMP) Moderate, High-Ready and/or High.

July 2026 For Official Use Only | Procurement Sensitive 9

• Provide a single-vendor solution which satisfies the controls of a FISMA High categorization.

• Provide a single-vendor solution that has Granular Role-based access control (RBAC) capabilities to provide access controls to data and content to include but not limited to assets, sources, reports, dashboards, alerts, and user-specific content.

• Provide a single-vendor solution that supports SAML authentication natively using Okta.

• Provide a single-vendor solution that can audit itself and report any changes made in the platform that includes full audit logging of all actions within the platform, including but not limited to:

o File Access – denied/allowed o SaaS, Hosting platform up/down o Server, Service, Node, Container, etc. state up/down o Server, Service, Node, Container, etc. Resource Utilization o Sessions not logged out o Sessions denied/allowed o User Maximum Concurrent Sessions Reached o Audit configuration change o User Command Execution (if available) o Device add/delete o Database User account Failed/Success Login o Database User / Group Account Management – add, delete, disable, enable, update, lockouts o Database object access – denied/allowed o Application User account Failed/Success Login o System and User Activity Audit Logging o Application User / Group Account Management – add, delete, disable, enable, update, lockouts o Privileged/elevated user access, actions.

• Provide a single-vendor solution which offers the ability to mask data prior to being written to storage/disk.

• Provide a single-vendor solution that can manage internal certificate and certificate distribution management (i.e., Certificate Authority Management solution).

• The vendor shall describe how the proposed SaaS SIEM solution aligns with FedRamp 20x initiative, including support for modern, automated security assessment and authorization approaches, continuous compliance validation, machine-readable security artifacts, secure-by-design principles, and the ability to reduce authorization and ongoing assessment effort throughout the system lifecycle. Vendor shall identify current capabilities, planned enhancements, and any dependencies required to support FedRamp 20x objectives.

July 2026 For Official Use Only | Procurement Sensitive 10

• The vendor shall describe how the proposed solution supports the Cybersecurity and Infrastructure Security Agency’s (CISA) Secure Cloud Business Applications (SCuBA) initiative, including the ability to ingest, normalize, correlate, monitor, alert, report, and automate response actions for SCuBA-supported cloud services and security telemetry.

The vendor shall identify native capabilities, available integrations, reporting aligned to SCuBA Secure Configuration Baseline, and any limitations or dependencies associated with supporting SCuBA compliance monitoring and operational visibility.

Data Pipeline

• Provide a solution that has the ability to collect data from agents collecting local system logs. This includes but not limited to the following data sources: Security, Performance, custom monitored directories.

• Provide a solution that has the ability to support all common log formats, such as CSV, Extended Log File Format (ELFF), Common Log Format (CLF), Key Value Pairs, JSON, Delimited Values, etc.

• Provide a solution that has the ability to maintain raw event format during processing of every event.

• Provide a solution that has the ability to route data based on data sources collected to multiple locations including but not limited to: S3 buckets, indexers, databases, mount points, other cloud solutions, etc.

• Provide a solution that has the ability to collect and route Syslog traffic using User Datagram Protocol (UDP) or Transmission Control Protocol (TCP) via multiple ports.

• Provide a solution that has the ability to query REST API endpoints using multiple security mechanism including but not limited to certificates.

• Provide a solution that has the ability to collect data from Cloud Service Providers (e.g., AWS, Azure, O365 GCC High, Zscaler, Google, identity provider (Okta), Endpoint Detection Response (EDR, CrowdStrike)) with the ability to segregate ingested data based on attributes within the data (i.e. segregate Component data within one tenant).

• Provide a solution that has a cloud presence in a FedRamp FedRAMP) Moderate, High- Ready and/or High certified environment.

• Provide a solution that has the ability to enrich collected data with external sources including but not limited to indicators of compromise, known Government information, or other Cyber Security relevant sources.

• Provide a solution that has information capture capabilities to include syslog, agent, API and/or other.

• Provide a solution that supports non-event information capture methods (e.x. syslog, API, agent, other).

• Provide a solution that supports compression, data filtering, and bandwidth management of collected data

July 2026 For Official Use Only | Procurement Sensitive 11 o Log exclusion and or ingestion filtering (log suppression), means DOJ does not ingest certain high‑volume logs into the centralized logging/SIEM to control noise and cost.

o Log sampling/summarization/rate limiting and even decentralized logging due to the high number of logs generated.

• Provide a solution that has the ability to integrate/leverage 3rd party technologies for data collection and enrichment (e.g., Apache Kafka, NiFi and Cribl LogStream).

• Provide a solution that has capabilities and user interfaces to collect and parse event and nonevent data from sources not natively supported.

• Provide a solution that provides the ability to filter out duplicate and extraneous events, trim unneeded content/fields from events and condense logs into metrics.

• Provide a solution that alerts when any system falls below federally mandated logging baselines (e.g., loss of identity logs, missing admin API events, missing segmentation logs) as required by EO 14028 and OMB M‑26‑14.

• Provide automated verification of log provenance (including cryptographic signing, chain‑of‑custody preservation, or hash‑linking) to ensure logs used in investigations remain tamper‑evident and immutable.

• Provide a solution that measures, reports, and displays logging maturity scores and coverage percentages for all agency systems, mapped to the federal logging tiers defined in OMB M‑26‑14.

• Provide a solution that validates end‑to‑end logging completeness by detecting missing, malformed, or silent‑failure log conditions across all required federal logging categories (e.g., identity, cloud control plane, authentication, privileged activity), in alignment with

OMB M‑26‑14.

User Behavior Analytics

• Provide a single-vendor solution without third-party solutions that has the capability to report on the behavior of entities and users.

• Provide explainable Artificial Intelligence (XAI), or Interpretable AI, or Explainable Machine Learning (XML) capabilities if AI/ML technology/capability is used within the solution.

• Provide security analytics on user behavior by correlating events across data sources for a user or users by IP address, Virtual Private Network (VPN) logs, Domain Name System (DNS) queries, etc.

• Provide a single-vendor solution that monitors and detects compromised user credentials for users and non-user accounts.

• Provide a single-vendor solution that monitors and detects privileged-user compromise for users and non-user accounts.

July 2026 For Official Use Only | Procurement Sensitive 12

• Provide a single-vendor solution that monitors and detects improper asset access for users and non-user accounts.

• Provide a single-vendor solution that monitors and detects compromised system/host/device/etc. for users and non-user accounts.

• Provide a single-vendor solution that monitors and detects lateral movement of threat actor for users and non-user accounts.

• Provide a single-vendor solution that includes collecting and monitoring user interaction with Department data across the Department’s ecosystem (endpoint, network, cloud environments, etc.).

• Provide a single-vendor solution that includes User Behavior Analytics that is capable of baselining user activity and alerts on deviations by individual activity deltas and individual to peer group deltas.

• Provide a single-vendor solution that has advanced prescriptive analytics or machine learning capabilities, such as statistical anomaly detection, peer group profiling or other sophisticated analytical approaches.

• Provide a single-vendor solution for profiling and anomaly detection, with prebuilt analytics, use cases, risk rating, etc.

• Provide a single-vendor solution that supports predictive or forecasting analytical capability.

• Provide a single-vendor solution the supports improved threat analytics by utilizing machine learning and artificial intelligence to detect anomalous user activities and help combat advanced threats.

• Provide a solution that can process data collected from other SIEM's through the user behavioral models.

Security Orchestration and Automation Response

• Provide a single-vendor solution without the need for third-party solution that includes:

o Visual, no-code playbook interface (e.g., visual playbook builder) o Pre-built, out-of-box automations including automated hunt and incident response playbooks; allow customization of pre-built, out-of-box automations o Ability to support "hybrid" playbooks/automation. (Automate then human interaction then Automate) o Allow direct editing of existing automation code and creation of custom automation code o Ability to enrich alerts and initiate actions with other security tools via integrations o Event correlation and aggregation for the purpose of improving security operations processes and alerting o Ability to transfer custom tasks/actions across playbooks o Ability to trigger alerts for detection and response actions o Ability to integrate with a variety of security products/services

July 2026 For Official Use Only | Procurement Sensitive 13 o Ability to pull or capture data from flat log files o Ability to store or retrieve information in tables o Ability to query indexed data o Support the ingestion of a wide variety of threat intelligence sources and formats from third-party sources, open-source, industry, and government o Provide bidirectional integration with systems such as JIRA and ServiceNow for case management o Metrics, tracking, and reporting of orchestration and automation benefits (e.g., time savings, cost savings, etc.).

Artificial Intelligence (AI) and Machine Learning (ML) Capability Requirements

• The vendor shall provide AI/ML capabilities that enhance security operations, threat detection, compliance, and mission resilience. The vendor shall address how their solutions meet or exceed the following AI-driven requirements.

• Automatically map collected telemetry to federal frameworks (e.g., FISMA, M2614, CISA guidance).

• Generate dashboards and compliance posture summaries.

• Identify gaps in log coverage or retention requirements.

• Recommend optimal storage tiering (hot/warm/cold/archive).

• Identify redundant, low‑value, or duplicate logs.

• Automate long‑term retention policies without impacting analyst search workflows.

• Provide plain English prompts (e.g. show me rare process execution) which are automatically translated into platform specific syntax

• Syntax optimization - AI analyzes the execution path, identifies syntax errors, and suggests optimal filtering sequences to prevent performance bottlenecks

• Agentic SOC capabilities to independently triage and investigate security alerts

• AI Guardrails against hallucinations, prompt injection, data leakage;

privacy‑enhancing techniques, role‑based access for AI features with post‑deployment monitoring

Operations and Maintenance (O&M) These System capabilities shall facilitate the system’s data migration and to facilitate its operation and maintenance:

• Provide monitoring and operations of Cloud Service Providers (CSP) and applications built within vendor service

• Container Monitoring and Orchestration for change management

• Mobile tools for Mobile devices

• Broad integrations and API support for multiple cloud service providers (AWS, Salesforce, Azure, Google, etc.), API for on-site applications built in other software languages

July 2026 For Official Use Only | Procurement Sensitive 14

• Remote access logs

• Must support on‑premises, hybrid, and cloud environments, with native integrations across all deployment models

• Provides intuitive and ease-of-use management and operations

• Provides ease-of-use interface and easy day‑to‑day operation

• Provides little to minimal maintenance burden

• Provides ease-of-use, straightforward rule tuning and alert management

• Provides clear pricing and storage options.

Version Release Cycles

• Version release cycles should not require updates to DOJ managed agents, appliances, or other components necessary to support SIEM dataflow and/or integration.

• The vendor shall provide an ability to define maintenance windows during which updates and enhancements are pushed to the cloud services.

• Provide test or sandbox environment/tenant to deploy and review test customer-deployed content prior to deployment of new content.

Professional Services

1. Migration The vendor shall provide consultant support for migration from DOJ’s current log management / SIEM solution, into the new, single-vendor SaaS solution in the time frame defined below.

Migration will include, but not limited to, knowledge objects, dashboards, alerts, searches, and indexes, and training.

Timeline and key milestones:

Post Award:

• Support Assessment/ATT/ATO: 90 days

• Training / Migration: 180 days minimum

The vendor must also support positioning DOJ to achieve OMB M-26-14 requirements (see:

Appendix C of OMB M-26-14):

• Logging Maturity Model for an Information System o Inventory Visibility o Collection Coverage o Collection Operations o Data Retention o Log Management

July 2026 For Official Use Only | Procurement Sensitive 15

2. User Training & System Documentation The Vendor shall provide training (user, administrator, engineer, architect, executive, etc.), training materials (e.g., user guides, job aids, in person, virtual and or video training, etc.), training certification thus enabling DOJ personnel to effectively use and maintain the vendor provided system. The Vendor will provide documentation of all architecture, deployment plans, test plans, custom code, etc. for DOJ and its Components. The vendor will provide documentation on how the vendor prevents vendor lock-in.

Response Content:

Respondents are requested to provide the following information. Responses should be concise and limited to information relevant to the Government's market research objectives. The Government is seeking sufficient information to assess the availability of capable sources, commercial solutions, applicable contract vehicles, and small business participation.

A. Company Information

Provide:

• Company name and address;

• Website, if applicable;

• Unique Entity Identifier (UEI);

• Point of contact, including name, title, telephone number, and email address;

• Business size (small or other than small) under the applicable NAICS code; and

• Identification of any applicable socioeconomic status, such as 8(a), HUBZone, Women-

Owned Small Business (WOSB), Economically Disadvantaged Women-Owned Small Business (EDWOSB), Service-Disabled Veteran-Owned Small Business (SDVOSB), or other applicable small business designation.

B. Capability and Relevant Experience

Describe the company's capability to provide the requirements described in this notice.

Provide up to 3 examples of recent contracts or commercial engagements involving similar requirements. For each example, provide, as applicable:

• Customer/agency name;

• Contract or order number, if applicable;

• Period of performance;

• Approximate contract/order value;

• Brief description of the products/services provided; and

• Contract vehicle or acquisition method, if applicable.

July 2026 For Official Use Only | Procurement Sensitive 16

C. Contract Vehicles and Commercial Availability

Identify any existing Government contract vehicles through which the required software licenses and/or services are available, including, as applicable, GSA Multiple Award Schedule (MAS), Government-Wide Acquisition Contracts (GWACs), Indefinite-Delivery/Indefinite-Quantity (IDIQ) contracts, agency-specific contract vehicles, or other Government-wide or agency contract vehicles.

For each applicable vehicle, provide:

• Contract vehicle name;

• Contract number or other identifier;

• Applicable SIN, CLIN, labor category, or other relevant identifier, as applicable;

• Contract expiration date; and

• Identification of any products or services that would be available through the vehicle versus those that would require open-market acquisition.

D. Licensing and Pricing Information

Respondents are requested to provide pricing information for the software licenses and related services identified in this notice. Pricing information is requested for market research and acquisition planning purposes and will not constitute a request for proposal, quotation, or offer.

Please provide, as applicable:

• The applicable licensing model (e.g., subscription, perpetual, term, enterprise, user-based, device-based, or other);

• Pricing for the software licenses identified in this notice;

• Any applicable volume-based or Government discounts;

• Recurring and non-recurring costs, including maintenance, support, implementation, or other associated costs;

• Any minimum license quantities or other commercial purchasing requirements; and

• Any other pricing considerations that would assist the Government in understanding the commercial marketplace.

Respondents may provide representative pricing, pricing ranges, or other commercially available pricing information sufficient to assist the Government in developing an understanding of current market pricing. Respondents are not required to submit a formal quotation or proposal in response to this notice.

E. NAICS Code and Small Business Feedback

July 2026 For Official Use Only | Procurement Sensitive 17

Identify the NAICS code(s) that your company believes best describes the principal purpose of the requirement described in this notice and provide a brief explanation supporting your recommendation.

For each recommended NAICS code, identify:

• NAICS code;

• Corresponding SBA size standard;

• Whether your company qualifies as a small business under that size standard; and

• Any other NAICS code(s) you believe the Government should consider based on the nature of the requirement.

The NAICS code(s) identified by respondents are requested for market research purposes only.

The Government will make the final NAICS code and size-standard determination for any resulting acquisition in accordance with applicable regulations.

F. Additional Market Information

Identify any information that the respondent believes would assist the Government in understanding:

• The availability of commercial solutions meeting the Government's requirements;

• Potential barriers to competition;

• Small business sources capable of meeting the requirement;

• Commercial licensing or acquisition considerations; or

• Alternative acquisition approaches or contract vehicles that may provide the required capabilities.

Response Instructions:

Information provided in response to this RFI must be submitted in accordance with the following instructions:

A. Portable document format (PDF) or Microsoft Word B. No more than 15 pages in length, including a two-page Capability Statement.

C. Must include a table of SLAs, performance metrics of the single-vendor solution D. Must provide demonstration on the capabilities of the offered solution and how it meets each requirement E. Provide Government reference for who currently uses the solution and successful use cases F. Times New Roman 12-point-font size, 8½ x 11-inch pages G. Responses are due by 11:59pm on August 28, 2026.

H. Responses shall be submitted via email to Contracting Officer, Raven Childs, at raven.r.childs@usdoj.gov. Emails cannot exceed 10mb.

mailto:raven.r.childs@usdoj.gov

July 2026 For Official Use Only | Procurement Sensitive 18

I. The Government is not required to respond to any questions submitted in response to this RFI. However, questions will be accepted by the Contracting Officer, Raven Childs, at raven.r.childs@usdoj.gov no later than 11:59pm ET on August 20, 2026.

J. Subject line of the Email shall include this Sources Sought Notice Number and the Vendor's Name.

K. If your response contains proprietary information, place notice of Proprietary Information after the Sources Sought Notice Number.

mailto:raven.r.childs@usdoj.gov