SPLUNK SAM.gov RFI DOC.pdf

DEPARTMENT OF THE AIR FORCE

AIR FORCE LIFE CYCLE MANAGEMENT CENTER (AFLCMC)

CRYPTOLOGIC AND CYBER SYSTEMS DIVISION

JOINT BASE SAN ANTONIO-LACKLAND, TEXAS 78243-7081

REQUEST FOR INFORMATION

UNIFIED DATA PLATFORM’S SECURITY AND

OBSERVABILITY

UNIFIED PLATFORM ENTERPRISE SERVICES ART

1 APRIL 2026

1.0 Purpose. This Request for Information (RFI) is issued in accordance with the Federal

Acquisition Regulation (FAR). This Request for Information (RFI) is conducting market research to identify unified data platforms capable of delivering integrated security and observability solutions for the Air Force Lifecycle Management Center (AFLCMC).

Cryptologic and Cyber Systems Division (CCSD), Joint Base San Antonio (JBSA) - Lackland, TX, for market research and planning purposes only. We are seeking information on systems that provide advanced capabilities in Security Information and Event Management (SIEM). The effort supports the Enterprise Services Agile Release Train (ART) for Unified Platform (UP). UP is responsible for developing and sustaining cloud-based platforms that enable cyber operations across the Department of Defense (DoD).

2.0 Disclaimer. THIS RFI IS NOT A REQUEST FOR PROPOSAL, INVITATION FOR BID, OR AN ANNOUNCEMENT OF SOLICITATION; IT IS ONLY INTENDED FOR

INFORMATION OR PLANNING PURPOSES.

2.1 There is no bid package or solicitation document associated with this announcement.

Response is strictly voluntary and will not affect a potential offeror’s ability to submit a proposal if a solicitation is released. Any requests for a solicitation package will be disregarded.

2.2 The United States Government (USG) does not intend to award a contract based on this RFI or otherwise pay for the information solicited. No entitlement to payment of direct costs, indirect costs, or charges by USG will arise for submissions in response to this RFI as well as subsequent USG use of information submitted. Submittals will not be returned to the sender. Respondents may be asked to provide clarifying information from initial submittals.

3.0 Background. UP employs Splunk’s platform to provide JCWA systems with the essential capability to effectively monitor, analyze, and respond to cybersecurity threats in real-time, fostering enhanced situational awareness at all levels. It ensures the defense against cyberattacks, preventing prolonged outages and data breaches across both Unclassified and High-side environments. To identify alternative solutions, UP is conducting market research to assess products and services that can fulfill the specific criteria outlined in this document.

3.1 The organizational objectives of this research are as follows:

3.1.1 Identify and catalog available products and solutions in the market.

3.1.2 Evaluate features, functionality, and pricing for each alternative to determine suitability for UP needs.

3.1.3 Assess each alternative’s integration and compatibility level for UP DevSecOps platforms, while ensuring compliance with DoD security requirements.

3.1.4 Estimate the level of USG resources required to integrate a new solution, while maintaining UP current operational capabilities.

4.0 Information Requested. The Government is seeking information on the following aspects of integrated platforms or software systems that provide security monitoring and compliance, threat intelligence and analytics, and incident response and reporting.

4.1 Security Monitoring and Compliance: The product must provide robust, real-time security monitoring across all systems and environments. It should offer a centralized logging platform to ingest data from diverse sources, ensuring comprehensive visibility and a unified view of system activity. The solution needs to support continuous compliance monitoring to ensure adherence to relevant security standards and regulations, providing a foundational layer for an auditable security posture.

4.2 Threat Intelligence and Analysis: The product must possess advanced threat intelligence and analytics capabilities to effectively detect, analyze, and identify malicious behavior. It should enable proactive threat hunting, allowing security teams to investigate system activity and uncover security incidents before they escalate into significant threats. Furthermore, the solution needs powerful data analysis and visualization tools to translate complex security data into actionable insights and support in-depth investigations.

4.3 Incident Response and Reporting: An equivalent solution must facilitate rapid incident response and timely, effective security investigations to counter cyberattacks. This capability is crucial for mitigating threats, preventing prolonged outages, and protecting against potential data breaches. The product must also feature interactive, customizable dashboards that provide leadership with a clear, CISO-level understanding of the organization's security posture, enabling informed, data-driven decisions.

4.4 The solution must also meet DoD Chief Information Officer (CIO) DevSecOps Reference Design compliance while providing continuous cybersecurity and testing.

This includes:

4.4.1 Enhanced Security: Supports Zero Trust Network Access (ZTNA);

enforces rule and policy customization aligned to unit security standards;

and enables resource invisibility with single packet authorization. The submission should also describe the product's capability to display classification banners on every page, detailing how it would be configured to show appropriate CUI markings and PII warnings.

4.4.2 Simplified Administration & Automation: Offers containerization and deployment through Helm charts; integrates robustly with other systems via APIs; supports Keycloak for streamlined user and group management, including automated profile creation and access control;

allows custom scripting for automated actions like user management, license retention, and space restriction; and facilitates complex administrative tasks with a Command Line Interface (CLI).

4.4.3 Auditing & Monitoring: Tracks all administrative events in an application Audit Log for System Administrator management and exports system performance data (CPU and memory) for monitoring and analysis.

4.4.4 Authentication & Browser Support: Permits Single Sign-on (SSO)

Authentication by either Common Access Card (CAC) or External Certification Authority (ECA) authentication and provides polyfills and runtimes to support browser APIs.

4.4.5 Training & Support: Includes comprehensive training and support resources for setup and installation.

5.0 Submission instructions.

5.1 Submit the response or comments and/or questions regarding this RFI in writing via e-mail directly to:

5.1.1 Contracting Officer: Mrs. Karin Werner, karin.werner.1@us.af.mil

5.1.2 Program Manager: Mr. Christopher Olvera Christopher.Olvera@us.af.mil

5.2 Response due date is Thursday, April 30th, 2026, 0800 CST. Please annotate the subject line of the e-mail as: “RFI Response: Unified Data Platform and SIEM for Unified Platform”. Include your contract vehicle, Commercial and Government Entity (CAGE) code, and Data Universal Numbering System (DUNS) number in the response. You may also include pricing data; however, it is not required.

mailto:karin.werner.1@us.af.mil mailto:Christopher.Olvera@us.af.mil

DEPARTMENT OF THE AIR FORCE