How Security Data Lake Licensing and Usage are Determined

The Red Canary Security Data Lake is licensed on a per-byte-stored basis. We add up the amount of raw data stored (excluding any meta data or parsed/translated data generated by us) when calculating license utilization.

Viewing recent license usage

The current data stored in the Security Data Lake is recorded on an hourly basis.

1. From the Red Canary homepage, click your user icon, and then click License Usage.

   

2. Review your current usage.

3. To see a breakdown of your current usage by integration or date of ingest, click View Usage.

Exceeding my license amount

When you exceed your license amount, Red Canary continues ingesting data received from all your data lake integrations. We do not want an unexpected increase in usage to impact your data retention compliance. However, data that exceeds the available space will not be searchable or exportable until the license is increased or data is deleted.

Red Canary then reviews your usage every three months and trues everything up at that time. If you had an overage, we calculate that overage and you can either increase your license amount (prorated for the remainder of your contract) or you can pay a one time overage fee. Increasing your license count is a good way to take advantage of volume discounts when available.

Calculate usage

License usage is measured based on the uncompressed, total size of the data we are currently storing in bytes.

Inconsistent numbers

Sometimes you encounter an edge case: you made a change to your log forwarder, and the numbers just don't look right. To make it easier to identify those oddities, the View Usage link above lets you see a breakdown of the data that you need to run these to ground.

If something still doesn't look right, let us know and we'll get to the bottom of it.