SS-24-010 - Darktrace AI and Machine Learning Software

Description

Vendor must supply an on-site appliance that uses Artificial Intelligence (AI) and machine learning to detect advanced threats, and must not rely solely on threat signatures or rule-based detection algorithms. The AI must be able to actively protect the entire ecosystem of the JTA network environment, intercepting threats in real-time. The AI must detect phishing emails by analyzing for high-risk activity based on JTA’s existing email usage patterns. The AI must also examine data from Local Area Network devices, cloud, Internet of Things, printers, scanners, digital signage, totems, Autonomous Vehicles, camera systems, and other transportation-oriented devices. The software must be able to detect activities that threaten JTA assets from the following four potential threat actors: External, Internal, Partners and Collusion. The product must also provide real-time security analysis regarding all incidents, and alert the JTA to abnormal activity with a threat severity score. The product must ingest log data from JTA source applications and hardware which would then be analyzed and investigated via machine learning. The product services must include general technical support from a vendor supplied Security Operations Center, so that the JTA may collaborate with the vendor when a potential incident occurs. Vendor services must offer daily (or weekly) human reviewed threat intelligence reports that highlight JTA’s recent security events. The vendor is responsible for the installation of their equipment and ensure they are able to remotely monitor their solution’s health.