​

Purpose

The Cyber Fusion Innovation Center (CFIC), in collaboration with U.S. Army Cyber Command (ARCYBER) and Army Cyber Technology and Innovation Center (ArCTIC), invites qualified industry partners to attend an in-person-only Collaboration Event to brainstorm limiting factors and potential solutions for the development of a containerized, cloud-native software application prototype designed to operate within the Cloud based Gabriel Nimbus big data platform. This prototype application will aggregate and correlate multi-source security logs to identify behavioral anomalies and indicators of compromise (IoCs) consistent with malicious cyber activity and Living-off-the-Land (LoTL) techniques.

​

Background/Synopsis

For some systems, security logs are ingested into Gabriel Nimbus and distributed across separate data Lakehouse buckets and tables organized by log type (Windows Event, DNS, HTTP, EDR, Netflow, Zeek, etc.). This siloed architecture creates significant operational friction:

• Manual Context Reassembly: Security analysts must manually correlate logs across multiple tables to establish behavioral context

• Inconsistent Analytics: Lack of automated correlation leads to missed detections and delayed threat identification

• Scalability Constraints: Current manual processes do not scale to enterprise-wide monitoring requirements

• Operational Inefficiency: Valuable analyst time is consumed on data wrangling rather than threat investigation

• The expectation is government purpose rights (GPR) in full perpetuity will be required

​

Questions?  

For submission-related questions, please contact Brandon Sizemore at bsizemore@cyberfic.org and Amanda Green at agreen@cyberfic.org.