Page Comparison

Overview of licensing introduced to the agents

end user can license via standalone or on network via SAM (highly recommended) - SAM may be operated on air gapped network; make licensing your agents quicker

will pick up functionality on the way; v2 will incorporate configuration of the agents;

What needs a license?  Snare Agent Manager - root licenses, agent licenses,

v5+ agents and SAM v1+, Snare Server v7+ products.

  NOTE: discuss version bump from vx to v5...consistent, up to same level

Licensing from a end users perspective consists of two different pathways.

• Standalone licensing
  

  Standalone licenses can be issued for either Agents, Snare Server or SAM. In standalone mode the agent will not talk to a Snare Agent Management Console to obtain its license. It will however still talk to it to provide details to SAM about its ip, license class etc.
  A standalone license is identified by the License-Type being either: EVALUATION, FULL.

  
  
  
• SAM based licensing
  
  In SAM Based licensing, SAM provides the licenses to the agents.
  Licenses provided to an agent are identified by the License-Type being either: CONTROLLER-EVALUATION or CONTROLLER-FULL.

Snare Agent Manager

SAM needs to be licensed first before can license other agents.  The license for SAM uses IA_SAM=1.

Then there is a feature license for your agents:

IA_LOG

IA_MSSQL_LOG

IA_MSSQL_LOG_HOST

SAM automatically sends a license (generated by itself) once a day to the agents, so the agents perpertually license for another 30 days,so if network is down the agents will log for another 30-days.

If after network is up, SAM will resend a license of internal (todays date) plus another 30 days.

THEREFORE agents will keep on logging for 30 days after they last communicated with SAM.

(Last Seen is the last time the agent contacted SAM, or if did a scan that SAM saw the agent)

The Snare Agent Manager controls the licenses that are required for the Snare enterprise agents to function.

The Snare Agent Manager license is generated by Intersect Alliance based on the Key Ids where it is installed.  When a new license is required ensure these Key Ids are provided by copying them to clipboard.

Quotas and Allowances

For each feature we have the number of allowances, so if you have IA_LOG=20, then you have twenty agents that have the ability to use that feature. Any enterprise agents will count towards that total including legacy (pre-v5), exception is OPENSOURCE (you may run as many as you like).

overlimit and under 60 days

If you have used 30 agents, and set up scan and SAM will see 30 agents.  The feature IA_LOG then goes into state=OVERLIMIT - so we have triggered a 60 day period for you to contact your rep/or manipulate the environment to only use 20 agents or less i.e come back to your allowance

overlimit and over 60 days

all v5+ agents will become unlicensed and will cease logging

-bring it back under or at (ie exhausted) , then rescan, and then okay.

AVAILABLE

the number of features available

EXHAUSTED

when the full license feature capability is used, eg IA_LOG=20 and 20 are utilized.

**EVALUATION

Snare Enterprise Agent

The Snare Enterprise Agent will display the display the active licenses registered to your organization.  You may license your agent depending on your network set up.

• If your agent is installed on a network then you also have Snare Agent Manager (SAM) installed that may push out all the licenses to your installed agents.
• If you have a standalone agent, installed on your desktop or device, then you will require to submit your Key IDs via the Snare License and Download Manager (SLDM), and add that license to your agent.

If SAM licenses the agent, then will see that in Licenses | page and it will be called LICENSE-TYPE= not full and not evaluation but another, so will know when SAM does it.

...