Splunk Security Information and Event Management

Requirement

TSA has a requirement for Splunk Enterprise and Splunk Enterprise Security software licenses and subscriptions, including associated maintenance and support, professional support services, and TrackMe software licenses. The additional software product is a mandatory component for the Security Information and Event Management (SIEM) system to operate at peak capability and is fully interoperable with the existing Splunk environment. These products are needed to ensure adequate licensing is in place to support the increase of daily ingestion rates of security event data, ensuring that the existing Security Information and Event Management (SIEM) system is configured properly and optimized to operate at peak performance to ingest and process security event data into actionable cyber security alerts and to support incident remediation activities, and to provide for the needed expansion and development of the SIEM system.