Network Detection and Response

The Department of State's Office of Cyber Monitoring and Operations is seeking a Network Detection and Response solution to replace and mature their current Enterprise Network Detection and Response. The solution should be able to monitor network traffic, detect anomalies, and respond to threats in real-time. The ideal solution will leverage advances in Artificial Intelligence and Machine Learning to streamline threat detection and response actions. The scope of the project includes monitoring and incident response responsibilities for various environments, including on-premises, cloud, and hosted networks. The contractor solution should be turned over to the Department for daily management and operations. Key features of the solution include: • Cloud-hosted SaaS solution with FedRamp certification • Consolidated management capability for centralized analysis, monitoring, and reporting • Role-based access controls and high availability of solution management • Capability to securely transmit logs to an external log management solution • Integration with external EDR and SOAR solutions • Ability to analyze raw network packet traffic and aggregate individual alerts into structured incidents • Automated responses and incident response capabilities • Ability to normalize and enrich collected data with contextually relevant information • Centralized management for deploying updates, configurations, and use cases • Deep inspection of application layer data and real-time capture and analysis of network traffic.