Tenders Are Invited For Implementation And Launch Of An Open-Source Siem System In The On-Premise Model

1. The Subject Of The Order Is The Implementation Of An Open-Source Siem System In The On-Premise Model, Including Agent-Based Computer Monitoring And Agentless Monitoring Of Infrastructure Devices At The Celestynów Commune Office, As Part Of The Investment Task Titled Improving The Level Of Cybersecurity In The Celestynów Commune.2. The Subject Of The Order Includes The Provision Of Design, Implementation, Installation And Configuration Services Consisting In The Implementation Of An Open-Source Siem (Security Information And Event Management) System, Operating In The On-Premise Model, Intended For Monitoring Security Events In The Ordering Partys It Infrastructure, Along With The Configuration Of Log Collection, Event Analysis, Preparation Of Detection Rules And Documentation Post-Implementation.3. The Purpose Of The Order Is To Implement A Central Security Monitoring System Enabling The Collection, Analysis And Correlation Of Events From It Systems, Detection Of Security Incidents, Increasing The Level Of Supervision Over The Infrastructure And Improving The Ability To Respond To Threats.4. The Scope Of The Order Includes: 1) Pre-Implementation Analysis Including The Identification Of Log Sources, The Scope Of Monitoring And Technical Requirements Of The Ordering Partys Environment, 2) Installation And Configuration Of An Open-Source Siem System In The On-Premise Model In The Ordering Partys Environment, 3) Preparation And Launch Of The System In The Ordering Partys Environment. Virtual Machine Compliant With The Proxmox Standard (Provided By The Contractor Or Implemented On The Ordering Partys Infrastructure), 4) Configuration Of System Components Responsible For: A) Log Collection, B) Event Correlation, C) Security Analysis, D) Alert Generation, E) Data Presentation (Web Interface), 5) Configuration Of Agent Computer Monitoring (Maximum 50 Workstations), Including: A) Preparation Of Installation Packages, B) Installation And Configuration Agents,C) Verification Of The Correctness Of Communication,D) Collection Of System Logs And Security Events,6) Configuration Of Agentless Monitoring Of Infrastructure Devices (Maximum 100 Devices), In Particular: A) Network Devices,B) Ups Power Supplies,C) Other Log Generating Devices,7) Configuration Of Log Collection Using Standard Protocols (E.G. Syslog, Snmp, Other Available Mechanisms),8) Preparation And Implementation Of A Basic Set Of Security Event Detection Rules, Including: Least: A) Failed Login Attempts, B) Privilege Escalation Attempts, C) Anomalies In System Traffic, D) Events Related To System Integrity, E) Basic Events Related To The Security Of Operating Systems, 9) Configuration Of Alerts And Notifications (E.G. E-Mail Or Other Available Mechanisms), 10) Preparation Of Dashboards And Views Enabling Event Analysis And Ongoing Monitoring, 11) Configuration Of Log Retention And Basic Data Archiving Rules, 12) Basic System Hardening, Including: A) Securing Administrative Access, B) Updating Co