Splunk Enterprise Security Premier Edition Licenses and Support

The procurement of licenses including software maintenance/service and support for Splunk products for the detection and defense against cyber attacks is being tendered, currently offered by the company Splunk under the product name Enterprise Security Premier Edition. Licenses and products for on-premises operation, i.e. for operation within the data centers of the NRW state administration, are to be offered. At a minimum, the following functions offered under the product name "Enterprise Security Premier Edition" at the time of writing must be offered - Security Information and Event Management (SIEM), - Security Orchestration, Automation and Response (SOAR), - User and Entity Behavioral Analytics (UEBA), - Cisco Talos Threat Intelligence for Splunk Enterprise Security In addition, the Asset and Risk Intelligence (ARI) function must be offered at no extra charge. The SIEM function is licensed based on the daily indexed log data volume (GByte/day). The SOAR, UEBA, and ARI functions are to be integrated into the basic license for an unlimited number of users, playbooks, and assets. If available on-premises, further functions can be offered (e.g. Attack Analyzer, Splunk AI and others). Software maintenance/service and support are also part of the tender. Further requirements are listed in the product questionnaire.