Licensing Overview

You must have Root scope to use this feature.

Stellar Cyber has licenses for the DP and for features. The DP licenses are:

• Volume—the DP is licensed based on the volume of data processed.
• Assets—the DP is licensed based on the number of daily active assets.

The license types are:

• Count—a given number of units is licensed.
• Device—a given number of units is licensed.
• Enable/Disable—the feature is either enabled or disabled, regardless of capacity.
• Volume—the feature is licensed for a given amount/time of work.

Each license has an expiration time. The license information is automatically downloaded from the cloud license server as needed. The information is filed under the One Time Password (OTP) assigned to the system at installation time.

Contact Stellar Cyber sales for pricing information.

About the License Tab

Click System | Licensing| to see a list of current licenses.

Expired and/or invalid licenses are included. If there is more than one block display mentioning the same license, the operational value is the sum of all license values applied.

Note that if the Support License is expired, any licenses for features that perform updates of definitions (such as the Exploit Detection and Malware Analysis licenses) will show a status of No Updates.

Click Asset Usage or Volume Usage to see details on the amount of capacity used. You can also click Usage Detail for the Platform License.

You can schedule or export PDF/CSV reports for these tabs from the Respond | Reports | License Usage page.

About the OTP Key

The License tab also includes an OTP Key field that lists the One-Time Password (OTP) used for the initial authorization of this DP and its associated sensors.

Getting More Information with License Usage Reports

In addition to the information provided in the Licensing page, Stellar Cyber also provides several useful reports to help you understand your asset and volume usage over different time intervals. Navigate to the Respond | Reports | License Usage tab to work with the reports listed below:

• Asset Usage

• Daily Average Volume Usage Per Asset

• Monthly Average Volume Usage Per Asset

• Volume Usage

About the Asset Usage Tab

The Asset Usage page shows you the daily maximum active assets over the preceding 30 days. If you have an asset-based license, your license limit is based on that average.

As shown in the image below, separate tabs in the Daily Asset Count By Tenant table let you view asset usage By Tenant or By Tenant Groups.

Each entry in the Daily Asset Count By Tenant table with a non-zero count includes a View Assets button. This button works differently depending on whether you are using Stellar Cyber classic asset counting implementation or the new approach available in 5.3.0 and later:

• Classic Asset Counting – Clicking View Assets lets you drill to an Investigate | Threat Hunting | Interflow Search filtered on the Assets index for the selected tenant and time range. This gives you an easy way to see the exact assets counted for licensing purposes in a given window of time

• Entity-Based Asset Counting – Clicking View Assets pops up an Asset Details view showing the entities detected for asset counting purposes for the specified tenant and time range.

Refer to Understanding Asset-Based Licensing for details on how assets are discovered, managed, and counted for licensing purposes, as well as the differences between Classic and Entity-Based asset counting.

About the Volume Usage Tab

The Volume Usage page shows you the data volume consumed for licensing purposes over the past 30 days by tenant.

Keep in mind that licensing volume is different than ingestion:

• Ingestion – Ingestion refers to the quantity of data sent by connectors and sensors to the DP prior to enrichment and compression.

• Licensing Volume Once data arrives at the DP, it undergoes additional enrichment and compression before it is stored on disk in the DP. Licensing volume refers to the quantity of actual data stored on disk, post-enrichment and compression. These are the counts used for licensing purposes.

Because of this distinction, the byte counts shown in the System | Licensing | Volume Usage page will not match those shown in the Visualize | Predefined | Ingestion Dashboard.

The table at the bottom provides the same information plus the index used.

Sorting the table by tenant makes it easy to see trends for each tenant.

Volume Usage Calculations Require 24 Hours for Completion

Keep in mind that it takes 24 hours to complete the volume usage calculations for a given UTC day. When a day ends in UTC time, its volume calculations are not final and may show small changes until the end of the next day in UTC time.

For example, consider the day of March 15, 2023. Stellar Cyber shows ingestion values for this day as soon as it concludes in UTC time. However, those values can and will show small changes for another 24 hours and are not complete until the end of March 16, 2023 in UTC time.

Payment Overdue Banner

If for some reason your account becomes overdue and must be paid, Stellar Cyber displays a banner to users with a Scope of Root, encouraging you to maintain your account in good standing. The message is only displayed once per session. You can acknowledge the notification and continue your work. Please make a payment as soon as possible to keep your account current.