2024-706-E-Emergency Svc-Motorola Solutions-PSC Radio System Service Maintenance

Browse Search

Orange County August 8, 2024 ASTRO 25 Managed Detection and Response 24-177976 / Cybersecurity Services Solution Description Use or disclosure of this proposal is subject to the restrictions on the cover page. Motorola Solutions Confidential Restricted Page 1-4 Security Advisories Security Advisories are messages initiated from the SOC that share information on active threats with the Customer’s security teams. These advisories guide security teams on how to best take action against a threat and tell them where they can find further information. Information Sharing The ActiveEye Portal includes several functions for sharing information. Automatic security alerts notify pre-defined contacts of incidents, based on incident priority. Other information sharing functions include: • SOC Bulletins - Instructions from the Customer, or the SOC, that SOC analysts reference when creating security cases. These can communicate short-term situations where a security case may not be needed, such as during testing or maintenance windows. • Customer Notebook - The SOC will use the Customer Notebook to document the Customer’s environment and any specific network implementation details that will help the SOC investigate security cases. • Contact Procedures - Escalation procedures and instructions on who to contact if an incident occurs. Contact procedures include instructions and procedures for specific security incident levels. The SOC and the Customer will jointly manage contact procedures. User Access The ActiveEye Portal provides the ability to add, update, and remove user access. Every ActiveEye user can save queries, customize reports, and set up daily email summaries. Users may be given administrative access, allowing them to perform administrative tasks, such a s setting up new service connectors, resetting passwords, and setting up multi-factor authentication for other users. 1.2.2 Service Modules ActiveEye delivers service capability by integrating one or more service modules. These modules provide ActiveEye analytics more information to correlate and a clearer vision of events on the Customer’s network. In addition, modules enable security teams and analysts to more easily access and compare data from these disparate systems. The following subsections describe each ActiveEye service module in detail. 1.2.2.1 Log Collection / Analytics The AERSS deployed in the Host’s system collects logs and other security information from applicable servers, workstations, switches, routers, Network Detection, and firewalls. This information is forwarded to the ActiveEye platform, which uses advanced analytics to identify signs of secu rity incidents. If it identifies signs of a security incident, ActiveEye notifies the SOC for further analysis. Collected events will be stored in the ActiveEye Security Management Platform to enable historical searching or threat hunting as needed. Some high volume, repetitive logs may be aggregated as noted in the documentation. The default s torage time period is one year, but no longer than 90 days, following expiration or termination of the Agreement. A longer time period can be provided if subscribed, see Table 1-2: Service Modules for subscription details. Docusign Envelope ID: AD07CE02-1F94-4496-ABD0-D61F9CBE562C