1. Your storage specifications seem high and will be expensive. Is that what you want?

We're not focused on cost at this stage. We're looking for the best solution that meets the specification.

2. For the minimum software specifications provided in the solicitation, will any be satisfied by GOTS or other government provided software?

No.

3. Can you provide additional information on the Joint Cyber Warfare Architecture (JCWA) software provisioning solution (JSPS)?

No.

4. Can you provide a list with the DoD standard hunt software load set?

No.

5. Can you provide a list of GOTS applications the government is likely to provide for the prototype project?

No. There aren’t any for this prototype.

6. What types of files will need to be automatically validated against known hashes, of any common hash type?

Files of all types will need to be validated against known hashes, of any common hash type.

7. What is the goal of the hash validation process?

The goal of validating file hashes is both to discover known malware files, and to validate that infrastructure-related files, such as operating system (OS) or firmware files, have not been modified.

8. What types of files would need to have a hash comparison?

Files of all types will need to be compared against known hashes, of any common hash type.

9. Would the customer provide the known good hash or would this need to be provided by the company developing the JCHK?

For each application in the software load set the vendor supplies as part of their prototype, the vendor must supply a hash value and its hash type.

10. Can you specify the storage requirements in terabytes for the ability to store at least 7 days of PCAP collected off a minimum of 3x10 Gbps full duplex and 90 days of logs and metadata on each server? This number varies greatly depending on the assumptions used in the storage calculation.

The storage requirement is not stated in terabytes because vendors may employ different data compression strategies in their storage designs. However, proposed designs must be capable of meeting all storage and processing specifications when all incoming data links are fully saturated. Log and metadata loads will vary depending on the infrastructure used by each mission partner. However, proposed designs must be capable of meeting all storage and processing specifications when hunt sites are large enterprises with numerous network and host logging functions enabled.

11. Is there an expectation for a "management approach" to be addressed in the Phase 1 response or will this be addressed later?

No. This effort is only for the delivery of a prototype. Management approach will be addressed at a later time.