Splunk Enterprise Security solution

Summary

The tender covers the supply of Splunk Enterprise Security licences, together with manufacturer software maintenance and support, for Techniker Krankenkasse's internal security operations centre. The solution must run fully on the contracting authority's on-premises IT infrastructure and combine SIEM and SOAR functionality. The bidder must offer a solution supporting at least 2 TB of log ingestion per day with 180 days of retention, Active-Active high availability, cluster expansion, log collection through various protocols and data sources, near-real-time detection rules, Python-based automation, Microsoft Defender for Endpoint and Grafana integration, and detailed security, logging, backup, encryption and patch-management requirements. The contract also includes manufacturer support, bug fixes, security updates and functional updates, 700 EDU credits per year and 10 ODS credits per quarter. The tender must be submitted electronically in German through the contracting authority's procurement portal by 7 September 2026 at 12:00. All price-sheet positions 1–7 must be priced; price is the only award criterion. The base volume is 1,000 GB per day and the test-and-development volume is 20 GB per day; optional extensions increase the main volume progressively up to 2,000 GB per day. The submission must include the offer letter, price sheet and suitability declaration, plus consortium, subcontractor and third-party documents where applicable. The compliance documents may not be altered and the bidder may not attach its own general terms and conditions.