Request for Information (RFI) - Next-Generation Security Orchestration, Automation, and Response (SOAR)

The U.S. Air Force AFLCMC Defensive Cyber Systems Branch is conducting market research to identify vendors that can provide a next‑generation, vendor‑agnostic Security Orchestration, Automation, and Response (SOAR) platform. The RFI seeks solutions that surpass current enterprise platforms (e.g., Palo Alto Cortex XSOAR) in openness, modularity, and ability to operate across cloud, garrison, and tactical edge environments. Respondents must detail how their product meets seven technical evaluation criteria covering containerized deployment, sustainment, open APIs, threat‑intelligence management, security controls, high‑availability in disconnected settings, visual playbook creation, ML assistance, and collaborative case management. No contract award is guaranteed; the RFI is for information only. • Target platform must be fully containerized (OCI‑compliant) and support multi‑tenant, lightweight tactical nodes. • Must provide extensive open‑integration marketplace (300+ integrations preferred) with SDK for custom connectors. • Requires native Threat Intelligence Management, FIPS‑compliant encryption, and evidence‑preserving data handling. • Must operate in high‑latency or offline tactical environments and sync back to central/cloud when connectivity returns. • Includes visual drag‑and‑drop playbook designer, Python/JavaScript scripting, and built‑in ML/AI assistance for analysts. • Collaborative incident workspace with ChatOps, real‑time multiplayer editing, and SOP‑driven task workbooks. • Vendors must outline sustainment via DoD/E‑SI, GSA schedules, training/certification pathways, and MOSA compliance.