|
3.1. Item. Implementation Of A Siem Class System Based On Wazuh Software (Or Equivalent) As A Central System For Collecting, Correlating And Analyzing Security Events From The Ordering Partys It Systems, Along With Rules, Dashboards, Notifications, Documentation And Instructions. The Order Covers The Basic Scope And The Scope Covered By Option Law.3.2. Basic Scope: 1) Installation And Configuration Of A Siem Server (Management, Indexing And Visualization Components) On A Virtual Machine Of The Ordering Partys Virtualization Platform (Provided In Part 2), In A Single-Node Architecture, With Encrypted Agent Communication, User Authentication With Roles (Administrator, Analyst, Read Only) And Configuration Copy; 2) Event Retention: Indexed Data Available For Search For At Least 90 Days, Event Archive For At Least 12 Months On Resources Indicated By The Ordering Party (S16 Matrix Or S21 Nas);3) Installation Of Agents On All Workstations And Servers Of The Ordering Party (Approximately 25 Agents: Windows Workstations, Domain Controller, File Server, Virtualization And Backup Platform Servers, Virtual Machines Implemented In Parts 2 And 3, S35 Switch Station), With Agent Groups And Centralized Configuration;4) Integration Of Agentless Sources Via Syslog Or Api: Stormshield Firewall, Two Cisco Catalyst 9200L Switches, Qnap Devices (S16, S21), Virtualization Platform, Backup Server, Radius Server If Launched By The Time Of Receipt;5) Active Directory Event Collection And Analysis: Successful And Failed Logins, Account Lockouts, Creation And Modification Of Privileged Accounts And Groups, Policy Changes, Use Of Administrative Accounts;6) File Integrity Monitoring (Fim) On A Domain Controller, Server Files And Platform Servers In Directories Agreed With The Ordering Party And Configuration Assessment (Sca) Of Servers According To Cis Patterns Available In The Software;7) Rules And Alerts: At Least 20 Correlation Or Threshold Rules Adapted To The Ordering Partys Environment, Including: Multiple Failed Logins, Logging In Outside Working Hours, Use Of An Administrative Account, New Privileged Account, Policy Change, Agent Unavailable, Change Of Critical Files, Malware Detection, High-Risk Firewall Events Priority, Switch Configuration Change, Failed Logins To Qnap Devices And Virtualization Platform, Session Start And End At The Transfer Station; Severity Levels And False Alarm Suppression;8) Notifications Of High-Priority Alerts Via E-Mail To Addresses Indicated By The Ordering Party, With A Daily Summary Of Events;9) At Least Three Dashboards: Security Overview, Authentication And Accounts, Integrity And Compliance; Monthly Report Generated From The System In Pdf Format;10) S35 Transfer Station: Siem Agent And Forwarding To The Siem The Events Of The Start And End Of Administrative Sessions With The Identification Of The User And The Purpose Of The Connection;11) Production Operation Of The System For At Least 5 Calendar Days Without Interruptions For Reaso
|
