The Red Canary platform is licensed on a per-endpoint basis. Our approach to measuring license usage is rooted in being as fair and transparent as possible. We have refined this approach over years to cover as many use cases as possible, including:

• Standard corporate environments where users are given laptops and/or workstations.
• Heavily virtualized environments where users are using virtualized/VDI desktops.
• Corporate datacenters comprised of servers that are rarely replaced.
• Cloud computing environments where servers are often replaced several times per month.

Viewing recent license usage

The number of servers and workstations online is recorded on a monthly basis.

1. Click your user icon at the top right of your Red Canary, and then click License Usage.
2. Monthly usage is shown in the Historical usage section.
3. Click ICON_DOWNLOAD to download a CSV of your endpoint usage.

Max Daily Active Servers and Total Active Workstations values de-duplicate counts for virtual machines using identical hostname and IP addresses. If your hostname and IPs are an exact match, we've altered our licensing logic to consider multiple endpoints to be the same endpoint for licensing counts.

Example:

The three endpoints here are counted in our normal endpoint counts. However, they count as two for licensing because the hostname and ip_address on sensors 1 and 2 exactly match. Since sensor 3 has a slightly different IP (10.0.102.57 instead of 10.0.102.56), it is counted as an additional license use.

We continue processing data received from all your endpoints. We do not want an increase in usage to harm your security.

We look at your usage every three months and true everything up at that time. If you had an overage, we calculate that overage and you can either increase your license amount (prorated for the remainder of your contract) or you can pay a one time overage. Increasing your license count is a good way to take advantage of volume discounts when available.

How is usage calculated?

We treat workstation operating systems differently from server operating systems for optimum fairness.

Servers - Each month we calculate the daily maximum number of servers for which we received data. This "high water mark" approach removes most overages you would incur because of replacing servers, refreshing Virtual Desktop Infrastructure (VDI), etc.

Workstations - Each month, we count the number of workstations for which we processed data. This accounts for systems that have accumulated data while not connected to the internet. It then requires Red Canary to process that data when the system comes back online.

What if something doesn’t add up or seem right?

Sometimes you encounter an edge case: you refreshed every single endpoint in a single month, and the numbers just don't look right. To make it easier to identify those oddities, the download links above let you obtain the data that you need to run these to ground.

If something still doesn't look right, let us know and we'll get to the bottom of it.

For more information, check out the Endpoints section.