How Endpoint licensing and Usage are Determined

The Red Canary platform is licensed on a per-endpoint basis. Our approach to measuring license usage is rooted in being as fair and transparent as possible. Over the years, we refined this process to cover as many use cases as possible, including:

• Standard corporate environments where users are given laptops and/or workstations.

• Heavily virtualized environments where users are using virtualized/VDI desktops.

• Corporate datacenters comprised of servers that are rarely replaced.

• Cloud computing environments where servers are often replaced several times per month.

Viewing recent license usage

The number of servers and workstations online is recorded on a monthly basis.

1. Click your user icon at the top right of your Red Canary, and then click License Usage.

2. Select the required usage tab.

3. Click View Data Table and then click to download a CSV of your endpoint usage.

Monthly Average Servers and Total Active Workstations values de-duplicate counts for virtual machines using identical hostname and IP addresses. If your hostname and IPs are an exact match, we've altered our licensing logic to consider multiple endpoints to be the same endpoint for licensing counts.

Example:

These three endpoints are counted in our normal endpoint counts. However, they count as two for licensing because the hostname and ip_address on sensors 1 and 2 match. Since sensor 3 has a slightly different IP (10.0.102.57 instead of 10.0.102.56), it is counted as an additional license use.

We continue processing data received from all your endpoints. We do not want an increase in usage to harm your security.

We look at your usage every three months and true everything up at that time. If you had an overage, we calculate that overage and you can either increase your license amount (prorated for the remainder of your contract) or you can pay a one time overage. Increasing your license count is a good way to take advantage of volume discounts when available.

Calculate usage

We treat workstation operating systems differently from server operating systems for optimum fairness.

Monthly Average Servers—Red Canary takes four samples per day with a one hour look-back window, counting all of the servers we’ve received telemetry from during the window (cloud and/or on premise). We will then average those counts together at the end of the month. As of September 2024, all new Red Canary customer servers will be counted in this fashion. Pre-existing customers who purchased an MDR Cloud SKU will also be counted under this new method. All other pre-existing customers will continue to be counted using the Max Daily Active Servers definition below.

Max Daily Active Servers—Each month we calculate the daily maximum number of servers for which we received data. This “high water mark” approach removes most overages you would incur because of replacing servers, refreshing Virtual Desktop Infrastructure (VDI), etc. Customers who purchased Red Canary prior to September 2024 will have servers counted this way, with the exception of customers have an MDR Cloud subscription applied to their domain.

Workstations—Each month, we count the number of workstations for which we processed data. This accounts for systems that have accumulated data while not connected to the internet. It then requires Red Canary to process that data when the system comes back online.

Inconsistent numbers

Sometimes you encounter an edge case: you refreshed every single endpoint in a single month, and the numbers just don't look right. To make it easier to identify those oddities, the download links above let you obtain the data that you need to run these to ground.

If something still doesn't look right, let us know and we'll get to the bottom of it.

For more information, check out the Endpoints section.