Royal Papworth Hospital NHS Foundation Trust: SIEM Solution

Tender description

Royal Papworth Hospital NHS Foundation Trust provide datacentre services from two locations on VMware vSphere clusters, with over 250 virtual systems. Each datacentre provides application services for users, including file storage, database and web hosting. Royal Papworth Hospital NHS Foundation Trust currently has no technology for centralised logging and analytics. A legacy solution is used for consuming syslog data from switches/firewalls but data storage is limited, and this provides no analytics. Investigations involve searching logs on individual appliances and attempting to piece data together manually which is very time consuming and gives inconsistent results. Royal Papworth Hospital NHS Foundation Trust require a SIEM solution to meet the following requirement: • Ingestion of logs from multiple sources spread across 2 datacentres and 3rd party hosting. Some resources are accessible from the Internet. • Perform threat analytics on those logs and allow correlation of data for investigations. Example Use Case 1 Royal Papworth Hospital receives alerts about endpoints exhibiting suspicious behaviour e.g. connecting to malicious websites. Because we use DHCP, we are unable to work out what endpoint was using that IP address at that specific time, what user was logged in to the device and what resources they accessed. Example Use Case 2 Security alerts such as malware breakouts are difficult to track and require manual investigation on multiple dashboards. Timescales on this project is for the complete delivery of solution no later than 31/03/2020 All Terms and Conditions are as per the NHS Standard T&Cs.