FAQ
Questions worth answering before a pilot.
EVIDRYN is explicit about what the current release supports, what remains manual and where analyst and customer responsibility begin.
DIRECT ANSWERS
Current pilot scope and boundaries
These answers describe EVIDRYN Pilot 0.2.0 and may change only through a documented future release.
What is EVIDRYN?
A local-first SOC investigation memory and decision-support platform that transforms Wazuh alerts into structured, explainable investigations while preserving analyst authority.
Is EVIDRYN a SIEM?
No. EVIDRYN sits above manually exported Wazuh alerts and does not replace alert collection, detection engineering or SIEM operations.
Does EVIDRYN replace analysts?
No. EVIDRYN organizes evidence and context. Analysts validate telemetry, record the final verdict and control every response decision.
Does EVIDRYN act automatically?
No. It does not contain endpoints, block IPs, close incidents, acknowledge alerts or execute response actions.
Does EVIDRYN connect live to Wazuh?
No. Pilot 0.2.0 supports manual authorized JSON, JSON-array and NDJSON export import only.
What data formats are supported?
Sanitized or authorized Wazuh JSON documents, JSON arrays and NDJSON exports within documented pilot limits.
Does EVIDRYN send data to the internet?
Offline investigation behavior is the default. Optional provider enrichment is separate, explicit and not required for the public demonstration workflow.
Can EVIDRYN be publicly hosted?
No. The founder-assisted pilot is localhost-first and must not be exposed through public port forwarding or a public reverse proxy.
Are backups encrypted?
No. Backups are integrity-verified with a manifest and hashes but are not currently encrypted. Store them securely.
What is Case Memory?
A deterministic comparison against eligible prior cases that returns visible matched signals and an explainable similarity score.
What is EVIDRYN Guide?
Display-only telemetry pivots, Event IDs and starter queries for analyst adaptation. EVIDRYN never executes them.
Who makes the final verdict?
The analyst. EVIDRYN never replaces or silently changes the authoritative analyst verdict.
How does the guided evaluation work?
A founder-led 45-60 minute synthetic walkthrough for up to two participants, subject to approval.
What is included in the founding pilot?
A bounded 14-day local pilot for one organization, up to three analysts and one workspace, with founder assistance and agreed data scope.
Why is pilot access controlled?
EVIDRYN is an early private pilot product. Controlled access keeps deployment, authorization and support boundaries explicit.
Why are USD and MAD prices different?
They are fixed regional commercial prices, not exact exchange-rate conversions.
Is payment completed through the website?
No. There is no checkout or payment collection. Terms and payment are agreed separately in writing.
Can customers download EVIDRYN publicly?
No. Approved pilot customers receive the private release during founder-assisted onboarding.
What happens after the pilot?
The founder and customer review results, limitations, defects, value observations and whether any next phase is appropriate.
How are vulnerabilities reported?
Use the configured private security contact and follow the responsible disclosure requirements. Do not test customer systems.