FAQ
Frequently Asked Questions
SecuTex NP and SecuTex ED are different products. The questions below are grouped by network-side investigation, endpoint-side governance, and PoC / licensing topics.
SecuTex NP
Network Evidence and Incident Investigation
NP helps fill gaps in network traffic records, packet evidence retention, and incident reconstruction.
How is NP different from a SIEM?
A SIEM mainly aggregates logs and events. NP preserves raw packet records so teams can reconstruct network behavior and incident context when logs are incomplete, overwritten, or deleted.
Where is NP typically deployed?
Common deployment points include core switches, perimeter switches, DMZ, office networks, server zones, and critical segments. Capture points are planned by topology, investigation goals, and traffic scale.
Will NP affect existing network services?
NP receives Mirroring / SPAN / TAP traffic through out-of-band capture. It does not need to be installed on endpoints and does not become a traffic forwarding node for production services.
Does NP decrypt traffic?
NP does not provide traffic decryption. If encrypted content must be analyzed, customers should decrypt it in their existing environment before sending the decrypted traffic to the capture point.
SecuTex ED
Endpoint Inventory, Compliance Checks, and Threat Screening
ED helps centralize endpoint status, compliance gaps, update posture, and suspicious threat indicators.
Does ED replace antivirus or EDR?
No. ED is an independent assessment and endpoint risk governance tool that complements asset inventory, compliance checks, endpoint screening, and third-party risk visibility.
How should we choose between On-Demand Scan and Persistent Agent?
Annual health checks, one-time inventory, and incident triage fit On-Demand Scan. Core servers, key hosts, and environments that need continuous configuration tracking fit Persistent Agent.
What endpoint data can ED collect?
ED can help collect endpoint assets, operating systems, update status, installed software, configuration check results, and threat indicators. Actual items depend on the edition and project settings.
Does ED support offline or isolated network assessments?
For endpoints in isolated or restricted networks, offline assessment and result import workflows can be planned according to the environment, helping teams review risk and compliance centrally.
Can the Agent be removed after assessment?
On-Demand Scan fits one-time or phased assessments and can be removed according to the project process after completion. Persistent Agent keeps the Agent in place to track endpoint status over time.
How do YARA and IoC matching help?
YARA rules and IoC matching help screen suspicious files, processes, and threat indicators, allowing administrators to focus first on endpoints that require further review.
PoC / License
Evaluation Preparation and Licensing
Before evaluation, prepare topology, endpoint scale, assessment goals, and expected outputs so the PoC scope can be defined clearly.
Can we request a Free Trial or PoC?
Yes. Share your network topology, endpoint scale, deployment environment, and audit or incident investigation goals so the team can evaluate a PoC or Free Trial arrangement.
What information should we prepare before a PoC?
For NP, prepare network topology, capture points, traffic scale, and retention days. For ED, prepare endpoint count, operating system versions, deployment method, Taiwan government GCB / financial-sector FCB or custom compliance baselines, and assessment scope.
How is licensing planned?
NP is planned by appliance specification and software term license. ED On-Demand Scan can use scan points or managed-host quantity tiers. ED Persistent Agent is planned by managed-host quantity tiers.
Can NP and ED be adopted together?
Yes. If both network-side evidence and endpoint-side risk data are needed, NP and ED can be evaluated in phases or together so incident investigation and endpoint governance complement each other.