Overview of licensing introduced to the agents
end user can license via standalone or on network via SAM (highly recommended) - SAM may be operated on air gapped network; make licensing your agents quicker
will pick up functionality on the way; v2 will incorporate configuration of the agents;
What needs a license? Snare Agent Manager - root licenses, agent licenses,
v5+ agents and SAM v1+, Snare Server v7+ products.
NOTE: discuss version bump from vx to v5...consistent, up to same level
Licensing from a end users perspective consists of two different pathways.
...
Standalone licenses can be issued for either Agents, Snare Server or SAM. In standalone mode the agent will not talk to a Snare Agent Management Console to obtain its license. It will however still talk to it to provide details to SAM about its ip, license class etc.
A standalone license is identified by the License-Type being either: EVALUATION, FULL.
...
Snare Agent Manager
SAM needs to be licensed first before can license other agents. The license for SAM uses IA_SAM=1.
Then there is a feature license for your agents:
IA_LOG
IA_MSSQL_LOG
IA_MSSQL_LOG_HOST
SAM automatically sends a license (generated by itself) once a day to the agents, so the agents perpertually license for another 30 days,so if network is down the agents will log for another 30-days.
If after network is up, SAM will resend a license of internal (todays date) plus another 30 days.
THEREFORE agents will keep on logging for 30 days after they last communicated with SAM.
(Last Seen is the last time the agent contacted SAM, or if did a scan that SAM saw the agent)
The Snare Agent Manager controls the licenses that are required for the Snare enterprise agents to function.
The Snare Agent Manager license is generated by Intersect Alliance based on the Key Ids where it is installed. When a new license is required ensure these Key Ids are provided by copying them to clipboard.
Quotas and Allowances
For each feature we have the number of allowances, so if you have IA_LOG=20, then you have twenty agents that have the ability to use that feature. Any enterprise agents will count towards that total including legacy (pre-v5), exception is OPENSOURCE (you may run as many as you like).
overlimit and under 60 days
If you have used 30 agents, and set up scan and SAM will see 30 agents. The feature IA_LOG then goes into state=OVERLIMIT - so we have triggered a 60 day period for you to contact your rep/or manipulate the environment to only use 20 agents or less i.e come back to your allowance
overlimit and over 60 days
all v5+ agents will become unlicensed and will cease logging
-bring it back under or at (ie exhausted) , then rescan, and then okay.
AVAILABLE
the number of features available
EXHAUSTED
when the full license feature capability is used, eg IA_LOG=20 and 20 are utilized.
**EVALUATION
Snare Enterprise Agent
The Snare Enterprise Agent will display the display the active licenses registered to your organization. You may license your agent depending on your network set up.
- If your agent is installed on a network then you also have Snare Agent Manager (SAM) installed that may push out all the licenses to your installed agents.
- If you have a standalone agent, installed on your desktop or device, then you will require to submit your Key IDs via the Snare License and Download Manager (SLDM), and add that license to your agent.
If SAM licenses the agent, then will see that in Licenses | page and it will be called LICENSE-TYPE= not full and not evaluation but another, so will know when SAM does it.
...
It is detected that your organization has more legacy enterprise agents than the new version 5 license allows. You have a 60 day grace period to contact your Snare Sales representative to update your license.
If your organization is oversubscribed, extra evaluation licenses will be supplied until fully migrated to version 5.
...
With the introduction of Snare version 5 Agents we're introducing a new licensing model. With this new model, Agents can be licensed in one of two ways:
- Using our new product, Snare Agent Manager (SAM). SAM enables Agents running on a network to be licensed from a central location. Better yet, SAM doesn't require an internet connection, so that means that even air-gapped environments receive the benefits. By choosing SAM as your Snare licensing tool, you'll not only be able to easily license all your networked Agents but you'll be primed to take advantage of exciting new Agent management features that we're already developing.
Directly via the Agents web UI management or command line interface.
For those that have Agents on a network and some that are individually air-gapped, don't worry. You're able to mix and match your SAM and standalone licenses to suit your operating environment.
What Snare Products Require A License?
Snare Enterprise Agents
All Snare Enterprise Agents from version 5 onwards require a license issued by Intersect Alliance. Snare Enterprise Agents can be licensed using SAM or by the installation of a standalone license. Evaluation licenses can be obtained via intersectalliance.com or by logging into your Snare License and Download Manager (SLDM) account. Full licenses can be obtained by logging into your SLDM account or from your Partner (if applicable).
Snare Enterprise Agents (excluding OpenSource) prior to version 5 do not require the installation of a license to function however operating such an Agent without an expliced agreement with Intersect Alliance or a Partner is a violation of the Snare Enterprise Agents End User License Agreement (EULA). Besides, when using legacy versions of the Agent won't be able to enjoy the latest and greatest features that the Agents have to offer.
Snare Agent Manager
SAM requires a minimum of two licenses to be installed in order for it to issue licenses to Agents:
1) A SAM Key License - This provides the SAM with a set of unique keys that used to ensure the integrity of all licenses issues by SAM to Agents. The keys do not expire however we highly recommend replacing these keys every three years or in the event they become compromised. A new SAM Key License can be generated at any time by logging into your SLDM account and following the prompts.
2) Agent Feature Licenses - This provides SAM with the ability to license Agents with a given feature such as Standard Audit / Epilog Logging, MSSQL Logging etc up to the amount requested during the evaluation or purchase application process. When multiple feature licenses are installed, allowances for individual features are aggregated when calculating overall usage allowances.
Snare Server & AMC
Snare Server version 7.1+ licenses are available as standalone licenses only and can be obtained from SLDM. Snare Server version 7.0 and version 6 licenses can be obtained from our Snare Support team.