Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Siem Monitoring Contract topic
No spam. Unsubscribe anytime.
Waukesha City IT Board approves 50‑hour SIEM monitoring agreement with TDI Vertical
Summary
The Waukesha City IT Board unanimously approved a Master Services Agreement and Statement of Work with TDI Vertical to provide Azure Sentinel monitoring and SOC support using an initial prepaid 50‑hour block with unused hours refundable after a 30‑day cancellation.
The Waukesha City IT Board unanimously approved a Master Services Agreement and Statement of Work with TDI Vertical on Jan. 7 that will give the company access to the city's Azure Sentinel SIEM to provide monitored alerts, ticketing and SOC triage.
Chris, the staff presenter, said the contract is intended to temporarily backfill duties after a senior systems engineer left and to provide threat‑hunting and incident triage. “We're gonna start off with a 50 hour block and they'll work down off of that,” Chris said, describing the engagement as time‑and‑materials with an option to refund unused hours if the city cancels after 30 days.
Under the proposed SOW, incidents recorded by the SIEM will generate tickets in the vendor's system; TDI analysts will triage tickets, run queries and create playbooks where appropriate, and assist on larger incidents. Staff said a tenant admin account would be created for the vendor and that the SOW is set up so lower‑severity alerts can be tuned not to generate billable tickets.
A board member raised concerns about language in section 5 of the MSA that seemed to grant broad authority to install software and limit prior vetting. The member stated, “Section 5 is extremely concerning,” and warned it could allow unchecked installs. Staff responded that the SOW contains an override clause and that the city attorney (Brian Running) had redlined the contract; staff said they would make sure the correct, redlined version accompanies the item to council.
Board members also asked about billing increments and whether one‑hour minimum billing could be reduced; staff said they would request the vendor reduce billing to smaller increments (15 or 30 minutes) and would tune alerting so low‑severity items do not generate billable work. The motion to approve the MSA and SOW — including authorization for the IT director to execute purchase orders for additional services as provided in the SOW — was moved and seconded and approved by roll call with all present members voting yes (mover: Mr. Hansen; second: Mr. Brooders).
