RFI Log Management & Analysis

Overview Hunter Water Corporation is seeking information regarding log management and analysis capability to inform future arrangements as its current Security Information and Event Management (SIEM) solution, Exabeam, approaches contract expiry. About Hunter Water currently uses Exabeam as its SIEM. It collects logs from Corporate and IT-managed SCADA environments, with security monitoring and alert triage performed internally. The current Exabeam contract is expected to expire on 29 September 2027. Purpose This initiative is intended to support applicable SOCI Critical Infrastructure Risk Management Program (CIRMP) obligations and alignment with ASD CI Fortify guidance, noting that compliance cannot be achieved solely through the adoption of a specific product or deployment architecture. Known Limitations and Drivers Some critical applications cannot be adequately monitored because of compatibility limitations Database audit logs are not currently collected Broader network security monitoring needs to be strengthened The current cloud-based service relies on connectivity that may be unavailable if SCADA is isolated during a cyber event, potentially reducing security visibility Hunter Water wants to consider opportunities to improve incident handling and response, including through Security Orchestration, Automation and Response (SOAR) Hunter Water is progressing towards greater separation of environments, for example SCADA Domain Separation and Infrastructure Management Separation