According to a request for proposals (RFP) from the city, requirements for the NDR software solution include being able to detect “network attacks such as vulnerability scans, network protocol poisoning, pass the hash and other Active Directory attacks; exploiting framework attacks such as Metasploit, Cobalt Strike or C2 communication; and actively stopping and responding to attacks without any interaction from IT personnel.”
Other software requirements include:
- Integrating with Office 365 via API and remediating any compromised accounts
- Implementing a heuristic-based approach to detect “zero-day” or “living off the land” techniques
- Correlating events to reduce the amount of time city analysts would need to investigate incidents
- Integrating with current security products used by the city, such as endpoint detection and response, firewalls, email protection and VPN solutions
Once all information is submitted, proof of authority to provide network detection response software to the city must be provided within 24 hours of the city’s request.
All vendor responses will be evaluated by the director of the city’s Office of Procurement Management.
More information about RFI No. 23-24-010 can be found online.