Fourniture et exploitation d'une solution de
 cybersurveillance managée (SOC), EDR et XDR

The contract is for a duration of 36 months and is not renewable. The execution period begins on the start date specified in the market notification.

Key milestones and phases include:

• Deployment phase: This phase involves a launch meeting to validate the scope, validation of prerequisites, planning of operations, and definition of technical and security contacts. It also includes the installation and configuration of antivirus, configuration of log flows, connection to the SIEM platform, configuration of detection rules, and alert parameterization.
• Competence transfer session: This session covers the presentation of the implemented architecture, consultation of alerts, log searching, interpretation of dashboards, best operating practices, and escalation processes.
• Contractual planning: The validated planning, which becomes contractual, includes the launch date, framing, integration of log sources, competence transfer, and production launch.
• Ongoing activities: Throughout the contract, management, support, and maintenance of the solution are required, along with quarterly committee meetings.

The core scope of work for this tender involves the provision and operation of a managed cybersecurity solution (SOC), EDR, and XDR for 36 months.

The firm scope of work includes:

• Renewal of antivirus/EDR SentinelOne protection for 900 licenses (600 user licenses and 300 server licenses) on compatible workstations, servers, and equipment (Windows, Linux).
• Supply and operation of the XDR solution and SIEM/SOAR tools, which includes the integration of EDR logs and specified external sources such as Microsoft infrastructures (AD, DNS, DHCP, Entra ID, NPS), Fortinet, F5, and Mimecast.
• A 24/7 managed SOC service encompassing surveillance, detection, qualification and investigation of alerts, incident response, proactive hunting, escalation, and recommendations.
• Implementation, skills transfer, support, maintenance, contract monitoring, and reversibility of the solution.

Key deliverables and documentation explicitly stated are:

• Technical Architecture Document (DAT).
• Exploitation Document (DEX).
• A monitoring dashboard.
• Monthly activity reports.
• An annual security review.
• A reversibility procedure.
• All documentation and deliverables must be in French and provided electronically.

The implementation and planning activities include a launch meeting, framing, integration of log sources, skills transfer, and placing the solution into production. The contractor must also provide a dedicated contact person for contract follow-up, support, and advice. Service commitments related to support hours, alert qualification times, escalation procedures, and communication channels are also part of the contractual obligations.