Supply Chain Notice: Cyber threat hunting hardware kit

Tender description

Processing power. Any solution must have sufficient processing power and memory to host and manage Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR) and endpoint forensics tooling to enable analysis of NetFlow and endpoint data by up to six on-site analysts concurrently, supporting the monitoring and analysis of enterprise-level computer networks in excess of 1000 endpoints. Data storage. The solution should include sufficient data storage to support full packet capture and analysis of relevant network and host data for an enterprise network of more than 1000 endpoints. The storage capacity must accommodate a continuous, real-time operation for a minimum of 90 days. Flexibility. To respond to both UK sovereign and partner tasks, the equipment should be able to support a variety of tools in a containerised virtual environment. Connectivity. This solution may be used to analyse data on non-internet connected (air-gapped) systems. As such, any solution should be able to ingest data forwarded from multiple customer networks and allow querying for up to eight on-site analysts concurrently via individual laptops, both with and without access to the internet. When circumstances allow, the equipment must also support a reach back / split-based capability, which would allow additional analysts in the home base to be able to connect to the equipment, interrogate the data and provide remote maintenance as the situation dictates. It should also include instant messaging chat and secure file-sharing tools to enable communication between forward and rear elements.