Functional Requirements

Secure x Design

Architecture

Detail the requirements of the infrastructure that Iberdrola must use to implement the solution.
Detail the pre-production (non-operational) environment included in the offer.
The solution must be integrated with corporate IT processes. Please provide details
- Backup management.
- Availability and capacity management.
- Possible integration of other agents.

Accessibility

The orchestrator will be accessed by several security teams, spread globally.
All tickets must be considered restricted information with access according to the need to know (defined by the personal profile).
Tickets must be able to be created:
- Directly by any of the company’s employees, eliminating the need for a small team of intermediaries to modify them.
- Through a web menu, this menu being configurable by the tool administrators.
- From the BMC Remedy solution from Iberdrola.
- From the Servicenow solution that Iberdrola is deploying this year.
- By e-mail.
- From the following SIEMS: ArcSight, QRadar, Splunk.
It should be possible to schedule ticket creation automatically for recurring tasks. For example, an automatic monthly ticket to manage and trigger a set of actions.
Tickets can be updated by anyone with access to the ticket as determined by the user profile. Ticket closing will also be determined by user profile.
The solution must be integrated with Active Directory.
Access to the system shall be controlled through Active Directory groups.
The system administrator shall assign the persons to their respective roles: Security equipment from Spain, security equipment from UK, security equipment from USA, security equipment from Brazil, GLOBAL security equipment with access to all of the above.
Job roles will have defined access levels to perform predefined functions; e.g. Admin, read-only, read-write, etc.
Global business lines and functions shall be defined hierarchically in such a way that a member of a global’ team has access to all local, regional or national entries.

1.1 WORKFLOW
1.1.1 The system will dynamically capture data automatically and associate it with each ticket:

A unique reference number per ticket.
The ticket opening time and the timestamp of the date.
The name of the creators.
Ticket resolution / closing time and date timestamp.
Mailbox monitoring.
1.1.2 Any entry of end-user data against the required fields shall be validated against the valid options allowed, with the exception of free-form fields such as title and incident details, etc.
1.1.3 The system should be easily adaptable to capture company specific event and event information from data provided by the company; e.g. priority, line of business, function, type of incident, other ticket references, etc.
1.1.4 The system should allow for the classification of the incident or potential incident by adding the fields:
1.1.1 Depending on the level of impact of the ticket, the solution will require one level of notification or another (immediate, daily, monthly…) and a different set of recipients. The solution should enable and assist the above-mentioned notification and situational awareness process.
1.1.2 A ticket may be categorized and re-categorized as many times as necessary.
1.1.3 The ticket creation process will use predefined algorithms to automatically calculate a priority and a ticket risk based on the data entered by the user.
1.1.4 The tool should allow the creation of’action’ or’root cause’ or’problem’ records to track specific follow-up actions for individual groups or users and allow them to be linked to’parental’ records such as incidents.
1.1.5 The tool will allow automatic ticket production through direct integration with other systems, such as a SIEM, or the provision of an API that can be used.
1.1.6 Enrichment of events. Each potential incident will be enriched according to the information provided (hostname, IPs, URLs, hashes, etc.). Enrichment will be done via API versus:
An Open Source Threat Intelligence Platform (MISP) solution.
IBM X-Force.
An Excel sheet (can be imported to another format manually on a regular basis) for asset classification with regulatory requirements (LOPD, GDPR, PCI, SOX….).
1.1.7 The system shall allow for the intelligent direct processing of notifications and ticket ownership to the appropriate equipment in the correct circumstances, based on the information provided in the ticket and the predefined logic.
Type of event / incident.
Priority.
Region.
1.1.8 The system will support the online workflow to allow easy monitoring and management of tickets based on criteria defined as priority, line of business, etc.
1.1.9 Tickets will be presented at different stages of the life cycle, including:
Open’ – newly opened but not assigned.
In progress’ – being worked on and assigned to an owner.
Resolved’ – incident resolved.
Closed’ – the resolution has been verified and the ticket is closed. (Optional step).
1.1.10 Ability to link additional information to a ticket, e.g. a Microsoft Office document. If the attached information is embedded within the application, you must follow the rules for classifying company information, restrict access to the required audience and encrypt’highly restricted’ information.
1.1.11 Recognition of predefined SLAs for ticket resolution within defined time scales, compared to ticket type, priority and seniority.
1.1.12 Creating specific fields (templates) for predefined events and event types. Specific event types will generate specific data fields for that type; for example, a hardware loss will request different data fields required for a phishing attack.
1.1.13 Customizable dashboards that allow easy and intuitive ticket management at all stages, including lists and graphical views.
1.1.14 Modify ticket recipients. Creation and storage of predefined technical procedures, so that they can be assigned automatically or manually to the tickets that, by their nature, correspond to them.
1.2 REPORTS
1.2.1 The tool will have a search function that allows the search of ticket metadata and keywords.
1.2.2 Audit trails of all actions taken manually by individuals or automatically by the system.
1.2.3 The solution will automatically produce an activity report on a monthly basis.
1.2.4 The solution will make it easy to create new reports.
1.2.5 The platform will be in production with the following reports implemented:
Security analyst activity report. Jobs/tickets managed by each analyst and grouped by security team (Spain, UK, USA, Brazil).
Report of services consumed / requested (incidents, vulnerabilities,…) grouped by security team (Spain, UK, USA, Brazil).
SLA report and management and resolution times by security team (Spain, UK, USA, Brazil).
1.2.6 Reports may be generated on demand and the period of time to be applied shall be variable (month, four-month period, six-month period, year) or the start and end dates of the period shall be selectable.

Domain	Functionality
Core function	Does the solution allow the client the creation of own workflows
Core function	Can the solution query external websites and aggregate the results? Please indicate for VirusTotal, Alexa.com, etc.
Core function	Can the solution remove / edit identifying information (based on Regex or similar) from data before sending it to external websites?
Core function	Can the solution create emails and send through SMTP/Exchange?
Core function	Can the solution automate security incident case handling?
Core function	Can the solution correlate related tickets by checking IP adresses against previous tickets by Service NOW (e.g. finding repeat offenders)
Core function	Can the solution aggrerate phishing campaigns based on the same sender address? (i.e. by querying Service NOW for previous cases)
Integration	Can the solution combine external information with internal databases (e.g. SQL/LDAP/ AD) to target VIP/HPU?
Integration	Does the solution integrate with FireEye HX?
Integration	Does the solution trigger an automatic quarantine using Fireeye HX and/or McAffee ePolicy Orchestrator?
Integration	Can the solution be used to synchronize IOC between different HX instances (please outline how)?
Integration	Does the solution integrate with Service Now?
Integration	Does the solution integrate with FireEye EX?
Integration	Does the solution integrate with FireEye CMS?
Integration	Does the solution integrate with Splunk?
Integration	Please indicate with which other products the solution can be interconnected
Integration	Can the solution use different playbooks / run books based on the kind of initial event (i.e. DDOS, Phishing, Malware)
	Data Architecture, Integration and Communications
	Specific Requirements for Cloud
	Technical Architecture
	Data Protection
	Access Control

Security
Provide a secure data layer	e.g. Encrypt the data in database so that it’s not exposed to external users	Threat Intelligence, Forensics
Provide a secure environment with supported functionality and processes relevant to C3/C4 data	Specifically to ensure that handling procedures mean that successful mitigation and resulting procedures are catered for	Threat Intelligence, Forensics
All Email notifications should be sent with digital signature for security so that recipient ensure legitimacy of email source	To prevent spoofing an email address	Threat Intelligence, Service Management, Forensics
Service Desk administrators will not have access to sensitive data	This is separation of duties. Service Desk and Service Support personnel will not be able to view sensitive data which has been identified as a result of security alerts	Threat Intelligence, Forensics
The system shall provide role based access rights	This enables the restriction of users &/or administrators to access areas of the system. (Role based access control)	Threat Intelligence, Data Hacking, Forensics
Application should be able to show different information to different users according to their roles	E.g. GSIM + SPOC (full detail); Management (high level, times, open tasks); … needs definition	Threat Intelligence, Service Management, Data Hacking, Forensics
Two factor authentication for login and access	supported through DUO directly on the platform	Threat Intelligence
All content needs to be encrypted on database level		Threat Intelligence, Forensics
User review/audit function will report/disable not used accounts after X days		General
IF C4, then limited search capability, reports and with requirements of NDA Checkbox upfront for even authorised users	for C4 a user will need to be specifically invited	Forensics

Interface
Capability for interface build to key security tools such as Remedy, ArcSight and Splunk Platforms		General, SIEM, Service Management, Data Hacking
Data from ArcSight (CEF, …) can be imported/exported		General, SIEM, Data Hacking
Data from Outlook can be imported/exported	Import emails, generate calendar items	General, Incident Management
Data from Remedy can be imported/exported		General, Incident Management, Data Hacking
Data from Splunk platforms can be imported and exported	Exchange + Certificate Signing, PGP, SMIME	General, Incident Management
Files can be uploaded through an API (moderated)	customisation commands from ArcSight, Remedy, other	General, Data Hacking
The system shall be capable of combining data from other security related systems	Interfaces available with other systems and data can be imported	General
A new instance can be added directly in the tool by any authorized user	User can manually enter new information to the application	General
New instances can be added by an customisation command from ArcSight	customisation commands can trigger a new instance	General
A new instance can be added with dedicated emails from Outlook	Emails can be received and automatically turn into an instance. Email Needs to have a standard tag to highlight that it is an incident	General
New instances can be added with an customisation command from Remedy	Tickets in ticket que can automatically turn into an instance. Can assign a due date/time to each task.	General
The application can export information in STIX or other security related IOC documentation		TI, Data Hacking
Access to application through mobile platform (statistical, management report, other)	Console is mainely browser based, but mobile apps to be available	Genearal/Management, Threat Intelligence, Service Management, Data Hacking
The application to work properly on browsers (Firefox, Chrome, Internet Explorer)		General, Threat Intelligence
Accessible via organisation standard web interface IE9 & IE10 & IE11	The system dashboard and other system tools to be accessible using IE9 & IE10	General
The application must not need any special libraries to run (client side)	No local java, no local flash, no Silverlight	General
An administration panel for the user rights can be enabled for special groups/users	New user, edit user, edit rights, edit roles, edit groups will be controlled by a master Administrator	General
An administration panel for reporting can be enabled for special groups/users	New report, selection of fields, scheduled reports, export file types will be controlled by a master Administrator. A user can only run reports on incidents that they can see.	Genaeral/manager
The application provides an admin interface to place help texts to functions or choices in the application	E.g.. Help text for instance creation, help text for different severity levels including links to URLs	General, Data Hacking
User information can be retrieved from active directory		General
User access controls should be based on groups, individuals and functions		General, Threat Intelligence
External users can be set up by a special user group	Non-Vodafone users can be created/disabled	General
An administrative function for ADDING/EDITING/DISABELING users (» THREE DEDICATED ENTRIES)		General, Incident Management
Every instance can be assigned to an individual		General, Incident Management, Threat Intelligence, Data Hacking
Every instance can be assigned to a group		General, Incident Management, Data Hacking
Each Incident can be assigned to a resolver group	This to ensure that no incident remains unallocated.	General, Incident Management
Every instance should have an owner	Each incident will have a creator, owner and members	General, Threat Intelligence
Every instance can be assigned to one or more entities	Group and individual	General, Threat Intelligence, Data Hacking
Every new instance will be assigned to the GSOC 1st line.		General
All unassigned instances will be assigned to the GSOC 1st line within 2 hours	DEPRECATED/REVIEW IN REGARDS TO ASSIGNMENT. n/a see above, FR12	General
Member of a cyber security group able to accepts/rejects instance	This would give a feedback loop to manually opened instances to the customer. A user can ‘resolve’ an issue and add a reason for closure in order to reduce false positives.	General
Assigned user can add and edit but not change the information log of the instances	Fields need to be defined. Observers should not be able to change any information. (Unable to link to any other databases with types or categories of incidents/threats etc.)	General, Data Hacking
Incident manager can mark data in instance as deprecated/hidden/false	Fields need to be defined. Incident manager can indicate who can see what in terms of users, but not based on specific fields for an incident	General, Incident Management
All state changes need timestamps and the actual user information, on who performed which action		General, Data Hacking
Incident manager can invite/block users to view/edit the instance.	Not only GSOC but also GSOC internally (e.g.. C4 instances)	General, Incident Management
Several users can append information to the instance at the same time but not able to overwrite each other comments	New information is moderated by Incident Management. Dialogue will notify users that they are not working on the latest version of an incident if any given field is being edited at the same time.	General, Threat Intelligence, Data Hacking
Updates to an instance need to be notified to responsible incident manager and assignee(s)		General, Data Hacking
An instance has information fields, which can/cannot be altered or edited by anyone	Fields need to be defined. Only ‘created by’ and ‘date created’ cannot be changed.	General, Incident Management, Data Hacking
An instance can be categorized by a severity.	Examples: S1, S2, S3, …	General, Incident Management, Data Hacking
An instance can be categorized by an internal complexity category	Examples: 1 client vs. 50 clients; 1 server vs. 30 servers, … (only internal measurements)	General, Incident Management, Data Hacking
An instance can be linked to another instance	Parent/Child relationship. Can be done Manually and automaticaly	General, Data Hacking
An instance can be cloned to a new instance	Fields, which are taken over, can be defined	General
An instance can be assigned to another group within cyber security community	GSIM to DE CSIRT to EH back to GSIM … // Ownership	General
Users outside the cyber security community can be invited to the instance with limited rights	Authorized by the instance manager	General
Files can be uploaded by a user (moderated)	User can manually upload new files to the application	General
Uploaded files will be handled in a protected way (malicious files have to be marked)	Password protection, alert before downloading, encryption, Can be uploaded manually	General
Uploaded files will be hashed/analysed	Timestamp, uploaded by user, file hash, file size, Can Have manual actions associated with attachment & then for added attachment can be sent to another system.	General, Incident Management, Data Hacking (generate the hash)
Attachments can be commented		General Data Hacking
Interface to Exchange or SMTP interface to generate emails	Sending (signed) emails from information fields from instance	General
Active Directory data to be maintained at 99.98% accuracy	Nothing is stored in AD – it is only queried	General
Active directory access for address book		General
An instance can be set to “request to close”		General
With categorizing an instance, a task list according to the use case action plan is initiated		Incident Management
An instance has different stages, which cover the lifecycle of an incident (may change in the future)	E.g.. Identification, Containment, Eradication, Recovery, Lessons Learned, Closed, Archived	General, Incident Management
The system shall enable grouped searches which result in targeted notifications and reporting. Those uninterested in a search, or set of searches, do not receive notifications or reports resulting from them	This avoids the ‘data dump’ method of reporting requiring recipients to sift and filter to find the items of interest. Equally it also precludes one set of users viewing reported items which they should not be privy to.	General
Search for previous/duplicated instances, additional information	Users from the cyber security community can search through all information on full text. Able to search on a variety of fields and text.	General, Data Hacking
An instance has different status, which cover the ticket lifecycle	E.g.. Assigned, in process, rejected, closed	General, Incident Management
An instance can be reassigned by dedicated people, even if the original owner is not available	Re-assignment if owner/manager is sick. Only an Administrator can reassign	General, Incident Management
An instance can be escalated to another person/manager manually	No feedback after time, No feedback on requested information	General, Incident Management
The system shall provide metrics to determine progress towards continuous improvement targets		General, Incident Management, Data Hacking
An instance can be escalated to another person/manager automatically	SLA times	General,
The service capacity shall be able to manage max number of users/network assets	500-1000 scalability required	General,
The capability to tailor make end user communications using messages template for alert to be sent to end users in order to take action	Notifications can be created according to the recipients own needs i.e. how the notification is formatted, what it contains and who it goes to	General, Forensics, Data Hacking

Quality Assurance functions
An instance can be reopened (and reassigned) with a given reason.		General
An instance has to be closed with a given exit code	Examples: Resolved, Unresolved, Duplicated, Merged, Rejected, …	General
Ability to create policies and the application needs to be compliant to these existing policies within Group	PCI, SOX, ISO, other (full set of policies need to be defined)	General
The application needs to accept exceptions to the policies for the local markets	Customers/local markets might not need to apply for the Group policies Exemptions can be applied to local markets/OpCos	General
An instance can be investigated/monitored/reviewed before closure		General, Data Hacking
QUERY FUNCTION / SEARCH CAPABILITY / FILTERING OVERALL	No query, but filter and search is available.	General
A DEDICATED FACILITY TO VIEW WORKING QUEUE / BACKLOG	backlog is a list of low severity or long running incidents	General
ISO 9001 SUPPORT CAPABILITY	ISO 9001 is an International Standard that gives. requirements for an organization’s quality manage- ment system (QMS). It is part of a family of standards. published by the International Organization for Stand-	General
Use of the system shall not adversely affect the performance of any other integrated systems or services nor the network upon which it resides	No degradation of other services and network functions during normal operation	General

Management and control functions
Incident manager needs dedicated view on all instances and their authorized users		Incident Management, Threat Intelligence
All information in the application needs to be classified with C1-C4 level statement	C3 is default setting	General, Threat Intelligence, Data Hacking
A user can have one to many different roles (SPOC, CTSO, CTO, other) for assignment purposes		General
The application can import and process IOC definitions e.g.. written in STIX	Yes for artefacts, otherwise no for anything importing manually	Incident mangement, TI, Forensics
Admin role with ability to add, edit or delete Users		Incident mangement, TI, Forensics
External Users can be set up by a special User Group		General, Incident Management
Keep reliable and accurate records and have the ability to track them with a full audit log		General
Improve the sharing of knowledge and best practices stemming from incidents and investigations		General
An instance can be categorized by one security category.	Examples: malware infection, Compromised host, … 19 Out of the Box categories already exist. Can also be assigned to more than a single category (e.g. malware and phishing)	General

Alerting
New instance triggers notification (email, internal popup, other) to assigned function		General, Threat Intelligence, Service Management, Data Hacking
SMS notification will be send for high critical instances.		General, Threat Intelligence, Service Management
Notifications contain instance number and URL to instance (no confidential information)		General, Service Management
Users must log in to the application to see any content/information		General, Threat Intelligence, Service Management
All notifications will be logged with the recipients, timestamp and content		General
An escalation mechanism shall enable the alerting and notification to be extended according to a user driven hierarchy.		General
An escalation workflow embedded in the communications function to allows auto escalation to a named line manager or team	This applies to both infrastructure failures remediated by VSSI, or Security Alerts. Built in (customisable) escalation paths ensure that where SLAs have been, or are about to be breached, a suitable team or manager is alerted.	General
Notification way can be configured per individual (email, internal, other)		General
The system shall provide alerts by log and alternative mechanisms and channels depending on a configurable range of alert types	Depending on the type of alert a pre-determined mechanism or channel can be used e.g. system log, screen, text, email etc.	General
A dashboard provides information and status about all queued instances & tasks		General, Service Management, Data Hacking

Reporting
The application can create reports manually (click by users)	5 standard templates are available and further customisable reports are available.	General, Threat Intelligence, Service Management, Data Hacking
The application provides different SLA times and KPIs based on the severity, category and status		General, Threat Intelligence, Service Management, Data Hacking
The application will create reports based on schedules (time or event trigger)		General, Service Management, Data Hacking
The application can create PDF reports from single instances	Containing all information, like a log, containing all related events, files, people	General, Threat Intelligence, Service Management, Data Hacking
Standard Reporting for each group	e.g. Incident management, Treat Intelligent, etc.	General, Forensics, Threat Intelligence, Service Management, Data Hacking
The application can create statistical reports	Opened/Closed cases per category/local market over timeframe (week/month/year). Additional analytical reports	General, Threat Intelligence, Service Management, Data Hacking
The application provides an interface to select fields for export.	each field can have a condition associated with it before it gets populated, i.e. a filed will only appear if a condition is met.	General, Data Hacking
The application can create report of several instances in CSV, XML, PDF	E.g.. Predefined reports can be used to extract 5 out of 20 fields in CSV for reporting. XML only via API	General, Service Management, Data Hacking
The system shall create configurable management information reports		General, Service Management
Event based ad hoc reporting	NEW REPORT, IF X > 10 or TIME LONGER THAN Y	General, Service Management
Dedicated facility for dedicated access via Mobile (e.g. Statistics)	Responsive UI	General
The system shall provide event/time ‘stamps’ for use in general and audit reporting.		General, Data Hacking
Reporting for role based, management information and ‘customer’ required.	Daily report. E.g. Availability of environment and status of control checks and reporting (Service Operations) I.e. not security alerts (Content and format to be determined)	General
The format of reports shall be configurable	In terms of style and layout and suitable as evidence of evaluation as required by operational managers, users as well as internal and external auditors e.g. high-level dashboards and technical reports	General, Service Management, Data Hacking
The system shall be able to send pre-determined reports to recipients	Either by email or other business standard mechanisms	General, Service Management
The system shall provide reports which support the service levels and key performance indicators devised to inform management of the service and satisfy auditors		General, Service Management, Data Hacking
The system shall provide reporting formats which allow targets and tolerances to be depicted.	This enables users to set target levels and acceptable tolerances which can be easily shown and analysed by recipients of reports.	General, Service Management
The service shall provide data access and reporting sufficient for external auditing needs	Provision of non-sensitive data and associated reports to provide external auditors with their requirements without transgressing data protection, or similar regulatory and legal standards	General
Management Reports of trend analysis	Real-time stats dashboard to show activity and progress of the live view of the incidents and related team and resolver activities for management purposes	General, Forensics, Threat Intelligence, Service Management, Data Hacking
The system shall provide a reporting package enabling operational and management information reports	Reporting from the database by standard, pre written reports, or by customisable query driven reports in an intuitive, graphical user interface	General, Service Management
		General
The system shall be capable of modular improvements and additions to provide further capability via formal change and release control mechanisms	Provision for staged approach to system and service improvements in the form of additional capability supporting the security evaluation, reporting and remediation activities	General
The reporting service shall be capable of being driven by predetermined service level agreements e.g. date driven	This enables the scheduling of reports according to differing service level agreements and reporting calendars.	General, Service Management
Exception Reporting “OUT OF SLA / KPI” EVENTS		General, Service Management, Data Hacking
Report on fact and duration of each issue	To illustrate how long it takes for each action to be dealt with	General, Forensics, Service Management, Data Hacking

Shiftlog functions
The system shall support Shiftlog entries	Require an analyst Shiftlog to make notes about occurrences etc.	General
The application provides a Shiftlog log function, where more information on What\How is required		General
Any information from the Shiftlog can be used as the core of a new instance at any time	Information like author, timestamp, content is taken over to new instance	General
Time limited Edit Function» Better versioning of all versions\Logs	For example we need a forum style comments log which allows a time limited change to be made for example if a comment has been made or a to made a correction. After 60 minutes all comments will be locked.	General
Mark evidence as DEPRECATED/INVALID	Resilient’s primary function is to provide an IR platform. Our use cases do not cover case management incluidng chain of custody	General

Workflow management functions
The application should be able to adopt and change “quickly” to the workflows.	Incident type can be changed at any time and dynamic changes are possible	General, Threat Intelligence, Service Management
ABILITY TO INTRODUCE A NEW / EDIT / REVOKE A WORKFLOW	SM Note: Workflow changes should be applied to “open” instances as well (not only new)	General, Threat Intelligence
MAINTAINANCE OF HISTORY WORKFLOWS		General, Threat Intelligence
STRATEGY OF WORKFLOW AMMENDMENT (CHANGES, TIMEFRAMES, OTHER)		General

Architecture
The application is scalable to the amount of users / data	More servers in cluster, more performance	General
The application can be run in a high availability cluster (EXTEND TO SINGLE ITEMS)	High cluster availability will be provided through VMWare	General
The application is compliant to the data centre standards	Process monitoring, Hardware monitoring, port monitoring	General
The system will allow for differing administration access rights depending on the role of the user	Master Admin will control access of other types of users.	General
Administrator access rights shall only allow individuals to view and administrate data pertinent to their area of control		General
Application should show different information to different roles	will be able to vary visibility for different user roles	General
An administration panel for the user rights can be enabled for special groups/users		General
All state changes need timestamps and the actual user, who performed which action		General
The application can be run in a high availability cluster (EXTEND TO SINGLE ITEMS)		General
Flexibility of design to allow for an increase in scope and usage in future years		General
The data retention period shall be: x Years, Y Months, Z days	nothing is deleted, and backups can be managed	General
The application is scalable to the amount of users / data		General
ARCHIVING OVERALL? – PERFORMANCE, SPACE, OTHER		General
Maintenance and support for environment		General
Field defenition, usage of REGEX to PARSE IPS or other		General

Runbook
Ability to create Play books/Run Books		General, Service Management
Linking incidents to threat intelligence		General, Threat Intelligence, Data Hacking
Support and simulation		General
Ability to create report trend on how often each run book is used and where a certain run book has not been used for a certain period time		General

Team Specific
Automated search facility and grouping results	To be able to search on related issues and create a dashboard/display of historic data on all related issues	Forensics, Data Hacking
If occurrence of an issue is greater than 1 to flag the issue and escalate the issue to responsible group	Create a report with number of occurrence and history of occurrences and escalate	Forensics
An automated security Marker(Classification) to lock down the issue to a certain/related team	So the issue won’t be open to unauthorised users	Forensics
Create new groups on functionality and lock down user accounts to the specific related functionality with fine grain security control		Forensics
Customizable dashboards on group and individual basis depending on workload and roles and responsibility		Forensics, Data Hacking
To enable to edit and have influence on the report	To be able to pull reports and edit it where applicable	Forensics
Task List with time stamps and action plans	Each individual can have a dashboard on their list of completed actions with the time taken to complete each action and a list of assigned actions in progress	Forensics
Enabled SharePoint and URL hyperlinks in the body of the incident which can be clicked on to take you to the related link		Forensics
Adaptable to type of situations	Template fields to be displayed depending on types of incidents and some fields could be made mandatory actions to follow	Forensics
Ability to create watch list		Forensics, Data Hacking, Threat Intelligence
Ability to assign group members to watch list		Forensics, Data Hacking, Threat Intelligence
Email notifications to be sent out to all users in watch list each time the status of watch list changes or the issues get updated		Forensics, Data Hacking, Threat Intelligence
A visual hierarchy to be displayed for Parent/Child tickets and issues	As well as linking related issues to enable visual hierarchy	Forensics, Data Hacking
Timer Widget to capture the time stamp and date of issues		Forensics
To enable creating dedicated new user groups that can view sensitive data	Authority level for related Senior & Incident management	Forensics
To create a dedicated portal to be used for requesting an activity or service	To follow a process to raise ticket fro service request	Service Management
To have a centralised list of escalation contacts depending on role and responsibility		Service Management
Secure central documentation/Service catalogue repository with enabled document versioning to be used and accessed by authorised users		Service Management
Links to be provided or ability to attach documents from repository		Service Management
Facilitate KPI and metrics reporting		Service Management
Create and automate KPI & Dashboard for Service and operational reports		Service Management
Enable product categorizations	E.g. Operational, Resolution, SLA for each ticket, customer and market categories	Service Management
Enable handling service, incident and change request		Service Management
Handling different category and subcategories of ticket and status		Service Management
Facility to create business continuity plan		Service Management
Analytical too, understanding narratives		Threat Intelligence
Searchable, searchable capability on individual fields		Threat Intelligence, Data Hacking
Automated alerts in email or text format on assigned issues		Threat Intelligence
Automated email alerts on priority issues and escalated issues		Threat Intelligence
Ability to email contents of STIX reports		Threat Intelligence
Simplification of data in STIX is enabled	E.g. Visual display at parent/child level in incidents	Threat Intelligence
Ability to have interface with other platforms	E.g. Silobreak	Threat Intelligence
Ability to create tailor made searching scenarios which can be saved for future use	multistring searching and search on specific fields	Threat Intelligence, Data Hacking
Creating a logical order of input to create a workflow process	Step by step logical flow to follow	Threat Intelligence
Creating and requesting automatic progress report on selected issues		Threat Intelligence
Ability to create a specific dashboard to display your team’s individually assigned issues, details on actions taken and progress		Threat Intelligence
Help & support option on process and required actions on set processes	Team to be able to edit, update and add new subject areas and process	Threat Intelligence
Email notifications each time assigned/raised issues status are updated/changed		Threat Intelligence, Data Hacking
Create trend profiles of the types of attacks and issues and ability to link a user or groups of users or URL etc. to that profile as knowledge share	This should be restricted to be viewed by authorised users within the team	Threat Intelligence
Ability to viewing and checking the quality of created issues by level 1 & 2		Data Hacking
Granularity on reporting and ability to create detailed reporting on chosen fields		Data Hacking
Trending capability reports and ability to search on issues that have same pattern or has a trend on same user		Data Hacking
Ability to create tailor made dashboards and ability to create tailor-made metrics		Data Hacking
Ability to search on related issues & creating a report of the list & summary of those issues		Data Hacking
Capability to refine and customize notifications and alerts		Data Hacking
To allow for external connectors for data import & export		Data Hacking
Catering for hand over and providing information logs for analysts transitioning to next shift		Data Hacking
Dedicated document storage repository for the use of authorised users only		Ethical Hacking
Ability to send out vulnerability alert and notifications to local markets and different users		Ethical Hacking, Service Management
Ability to create a record of vulnerability notifications and alerts		Ethical Hacking
Reports, Alerts and Notifications should have customized Vodafone look & feel		General, Service Management
Tool should have an integrated CMDB		SIEM Team

Audit Logging

Requirement	Description
Confirm your application will log user access attempts (Pass/Fail)?	Failed and successful user log ins, including the user name, date, time they logged in
Confirm your application will log user sessions or user activity (if different to logon/logoff) ?	Tracking of user sessions on the application including user name, time and date of session
Confirm your application will log escalation of user privileges?	Application logging when a user has escalated privileges including the user who made the change and the user who’s rights have been altered
Confirm your application will log use of administrator accounts	Logging when an administrator account is used or escalated rights are used to perform functions such as SU Root on Unix
Confirm your application will log system changes/updates?	Application logging when new patches or changes have been deployed
Confirm your application will log system errors/ critical errors?	Logging of system and critical errors including error code, time and date
Confirm your application will log application stop / start / resets, error conditions, failures and threshold exceptions?	Creating a log entry when the settings for logging events has changed or logging has failed. Also log start / stop times
Confirm your application will log backup activity?	Logging when backups are taken and if they fail
Confirm your application will log changes in storage levels?	Logging when the storage levels for servers/databases have been altered
Confirm your application will log terms and condition accepts/declines by users	Logging when a user accepts or declines the terms and conditions for the application
Do you foresee any application specific events being raised to SIEM?	Does your system log specific security events which should be captured by SIEM? This is particularly relevant for systems which answered yes to question 19 (Provide security enabling functions) . Please enumerate answers

Security Orchestration, Automation & Response (SOAR)

Participants3

Functional Requirements

Secure x Design

Audit Logging