Section

Type

Requirement

Platform

Mandatory

1) Log Management System capability

2) Supporting an extended set of log sources

3) Customization of parsers/connectors

4) Method for retrieving events/flows/logs

5) Specification of the method for retrieving events/flows/logs

6) Hierarchical and modular/scalable architecture

7) Time-zones management

8) Platform computing capacity

9) Platform storage capacity

10) Installation model

11) High Availability/caching options

12) Availability of both default and customizable correlation rules

13) Dashboard features: ability to prioritize response and analysis

14) Customizable and compliance reports

15) Alerting capabilities

16) Technical documentation and online help

17) Ability of Monitoring the platform

18) Secure Software

19) Context enrichment based on collected logs

20) Support for collection of real-time and deferred logs

Nice to have

1) Multi-tenant capabilities (views)

2) Anonymization of logs

3) Support MITRE ATT&CK correlation matrix

Operations

Mandatory

1) Role-based access control

2) Accounting: log events done by operators

3) Web interface for day-by-day operation

Nice to have

1) Customizable time-zones for the GUI

Integration

Mandatory

1) Active Directory integration for administrative management

Nice to have

1) Integration with asset management tools

2) Case Management and trouble-ticketing activities tracking

3) Trouble ticketing module

4) Integration with vulnerability management tools

Advanced features

Nice to have

1) Threat Intelligence analysis tools support

2) Support for forensics analysis activities

3) Analytics support

4) Automatic response capabilities

Licensing and support

Mandatory

1) Specification of the preferred License type

2) Licensing restrictions

3) Specification of the project Roadmap

4) Delayed license activation

5) Technical assistance support and professional services

6) Training provided