SW pro SIEM

The contract timeline includes two main phases. The first phase is expected to be completed by December 10, 2026. The second phase will run from January 1, 2027, to December 31, 2027. The start of the second phase on January 1, 2027, will involve the installation and activation of licenses, as well as the commencement of support.

The core scope of work for this tender involves the delivery, installation, and implementation of a comprehensive Security Information and Event Management (SIEM) software solution. The system is required to collect and evaluate operational and security events, focusing on cybersecurity, and to consolidate and analyze operational events in real-time. It must meet the requirements of Act No. 264/2025 Sb. and Decree No. 409/2025 Sb., and allow for future expansion to include functionalities like the automation of security incidents.

The Statement of Work is structured into two main stages:

Stage 1: Implementation

• Complete delivery, installation, and configuration of the SIEM software in the client's system environment.
• Installation of software, agents, and configuration of the SIEM system.
• Integration for managing authorized users and other systems as specified in the contract annexes.
• Configuration of automatic regular log archiving (e.g., daily, weekly) and automatic backup of the SIEM system (configuration and data).
• Configuration of data processing, including collection and normalization.
• Documentation covering native and custom integrations, backup, archiving, log and data restoration, implementation procedures, integration procedures for new devices (parsing, normalization, correlation rules), regular maintenance, diagnostics, monitoring, emergency state resolution, and configuration/data backup/restoration.
• Provision of training for a minimum of 4 client employees on routine operation, maintenance, configuration changes, problem resolution, user rights management, device monitoring, backup/restoration, log/data recovery, view/report creation, correlation rule creation, source management (including custom sources), incident detection/analysis, and custom log processing.

Stage 2: Support

• Ongoing provision of support services as defined in the contract.
• Delivery and installation of all necessary licenses required for the operation of the SIEM system.

The SIEM solution must be capable of processing at least 200GB of logs per 24 hours, with options for future expansion. It is primarily for on-premise infrastructure but must support hybrid or cloud environments. While SOAR functionality and asset inventory are not part of the initial project if they require separate licenses, the solution must enable future expansion to include these capabilities.