Overview of licensing introduced to the agents
End user can license via standalone or on network via SAM (highly recommended) - SAM may be operated on air gaped network; and is designed to make licensing your agents quick and simple.
The SAM application will evolve and will pick up new functionality on the way. The next version 2 will incorporate configuration of the agents and replace the existing AMC in the Snare Server.
What needs a license?
- Snare Agent Manager
- Integrity key licenses
- agent feature licenses
- If agents are in standalone mode then the agent will need a standalone license key
All the Snare products will now require a license to operate including v5+ agents and SAM v1+, Snare Server v7+ products.
As part of the upgrade to the Snare Agents all of them and moved up to a new baseline called version 5 as they all have the same basic feature set. This as resulted in some agents skipping some versions like the SQL agent and Epilog.
Licensing from an end users perspective consists of two different pathways.
...
Standalone licenses can be issued for either Agents, Snare Server or SAM. In standalone mode the agent will not talk to a Snare Agent Management Console to obtain its license. It will however still talk to it to provide details to a SAM about its ip, license class etc.
A standalone license is identified by the License-Type being either: EVALUATION, FULL.
...
Snare Agent Manager
SAM needs to be licensed first before can allocate a license to Snare agents. For permanent license strings Intersect Alliance need the KeyiD's from the SAM under the Licenses tab to provide a license to the SAM.
This license for SAM will also use a IA_SAM=1 feature reference.
Then there is a feature license for your agents:
IA_LOG = nn
IA_MSSQL_LOG = nn
IA_MSSQL_LOG_HOST = nn
SAM automatically sends a license (generated by itself) once a day to the agents, so the agents are perpetually license for another 30 days,so if network is down the agents will log for another 30-days.
If after network outage is resolved the SAM will resend a license of internal (todays date) plus another 30 days.
THEREFORE agents will keep on logging for 30 days after they last communicated with SAM.
(Last Seen is the last time the agent contacted SAM, or if did a scan that SAM saw the agent)
The Snare Agent Manager controls the licenses that are required for the Snare enterprise agents to function.
The Snare Agent Manager license is generated by Intersect Alliance based on the Key Ids where it is installed. When a new license is required ensure these Key Ids are provided by copying them to clipboard.
Quotas and Allowances
For each feature we have the number of allowances, so if you have IA_LOG=20, then you have twenty agents that have the ability to use that feature. Any enterprise agents ( except the SQL agent ) will count towards that total including legacy (pre-v5), the exception is OPENSOURCE (where you may run as many as you like).
overlimit and under 60 days
If you have installed 20 v5 agents and the SAM shows these 20 as operational. If you now set up a scan in the SAM and discover another 10 legacy enterprise agents you will get an over usage warning. The feature IA_LOG then detects that you have gone over your license limit and goes into a state=OVERLIMIT - this has now triggered a 60 day warning period for you to contact your sales rep/or manipulate the environment to only use 20 agents or less i.e come back to your allowance
overlimit and over 60 days
eg get to 61 days and we still have 30 agents( 20 v5 and 10 legacy enterprise agents) ;
The system will now unlicense as many v5 agents first until get to attempt to come back up the license limit. So if 10 v4 agents and 20 v5 agents, then the SAM will unlicense the 10 v5 agents until it goes back to limit of 20 - then OVERLIMIT will become EXHAUSTED where no new licenses can be allocated until the license quote is upgraded.
eg get to 61 days and we still have 30 agents, 25 v4 agents plus 5 v5 agents; it will unlicense ALL the v5 - since more v4 agents than the license spots so can't get back to EXHAUSTED, and will always be OVERLIMIT.
SAM will allocate licenses up to the license exhausted limit and will only end up an an over-limit state if other legacy enterprise agents are detected and the total number of agents exceeds the license quota..
Some of the terms in use are:
AVAILABLE
- the number of features available on that particular license
EXHAUSTED
- when the full license feature capability is used, eg IA_LOG=20 and 20 are utilized.
EVALUATION
- usually designated for time based evaluation of the Snare software.
Snare Enterprise Agent
The Snare Enterprise Agent will display the details of the active licenses registered to your organization. You may license your agent depending on your network set up.
- If your agent is installed on a network then you also have Snare Agent Manager (SAM) installed that may push out all the licenses to your installed agents.
- If you have a standalone agent, installed on your desktop or device, then you will require to submit your Key IDs via the Snare License and Download Manager (SLDM), and add that license to your agent.
If SAM licenses the agent, then you can see the status on the Licenses page and it will be referenced as LICENSE-TYPE= full or evaluation, so it will be easy to see when SAM does the licensing or not at the agent level.
Warnings can occur when it is detected that your organization has more legacy enterprise agents than the new version 5 license allows. You have a 60 day grace period to contact your Snare Sales representative to update your license.
If your organization is oversubscribed, extra evaluation licenses maybe supplied until fully migrated to version 5.
For existing customers, Licenses will be downloadable from the Intersect Alliance site Snare License and Download Manager (SLDM) based on your current purchase of software.
Example: Customer A was evaluating Snare Ent Agents utilizing SAM, in which they received 2 licenses - both for SAM (1 Integrity Key and 1 feature license). Cust A has purchased Snare, what the happens with the licenses/what do you need?
Once the PO phase gone through to completed - and the customer has supplied the KEY IDS from their production SAM - the full licenses will be auto generated and will expire within purchased time span as required. During the PO submission a user will have the ability to download evals for the full license allotment of the PO (for default 30 days or more depending on their purchasing arrangements) - once the payment has been received the customer will get their full licenses.
if more evaluations are required then they can be added to SAM to cover the additional agent features.
if additional licenses are purchased they can be added to the existing install or obsolete the existing license and provide a new total.
Obsolete Licenses
An Obsolete license can be used when (and if staying at same usage count) the customer is renewing licenses in advance (ie on 12 month support and renewing), we will issue them with new licenses for duration of the 14 months but obsolete existing licenses that they have but will have a 2 month window where their support period is extended.
If the customer is changing their usage count and upping the feature quantities then a new license can be allocated to obsolete the existing features and provide new feature totals.
Networks & License
Deleting a network doesn't delete the agents on that network. SAM still knows about these agents and as a result all enterprise agents will continue to count towards license usage.With the introduction of Snare version 5 Agents we're introducing a new licensing model. With this new model, Agents can be licensed in one of two ways:
- Using our new product, Snare Agent Manager (SAM). SAM enables Agents running on a network to be licensed from a central location. Better yet, SAM doesn't require an internet connection, so that means that even air-gapped environments receive the benefits. By choosing SAM as your Snare licensing tool, you'll not only be able to easily license all your networked Agents but you'll be primed to take advantage of exciting new Agent management features that we're already developing.
Directly via the Agents web UI management or command line interface.
For those that have Agents on a network and some that are individually air-gapped, don't worry. You're able to mix and match your SAM and standalone licenses to suit your operating environment.
What Snare Products Require A License?
Snare Enterprise Agents
All Snare Enterprise Agents from version 5 onwards require a license issued by Intersect Alliance. Snare Enterprise Agents can be licensed using SAM or by the installation of a standalone license. Evaluation licenses can be obtained via intersectalliance.com or by logging into your Snare License and Download Manager (SLDM) account. Full licenses can be obtained by logging into your SLDM account or from your Partner (if applicable).
Snare Enterprise Agents (excluding OpenSource) prior to version 5 do not require the installation of a license to function however operating such an Agent without an expliced agreement with Intersect Alliance or a Partner is a violation of the Snare Enterprise Agents End User License Agreement (EULA). Besides, when using legacy versions of the Agent won't be able to enjoy the latest and greatest features that the Agents have to offer.
Snare Agent Manager
SAM requires a minimum of two licenses to be installed in order for it to issue licenses to Agents:
1) A SAM Key License - This provides the SAM with a set of unique keys that used to ensure the integrity of all licenses issues by SAM to Agents. The keys do not expire however we highly recommend replacing these keys every three years or in the event they become compromised. A new SAM Key License can be generated at any time by logging into your SLDM account and following the prompts.
2) Agent Feature Licenses - This provides SAM with the ability to license Agents with a given feature such as Standard Audit / Epilog Logging, MSSQL Logging etc up to the amount requested during the evaluation or purchase application process. When multiple feature licenses are installed, allowances for individual features are aggregated when calculating overall usage allowances.
Snare Server & AMC
Snare Server version 7.1+ licenses are available as standalone licenses only and can be obtained from SLDM. Snare Server version 7.0 and version 6 licenses can be obtained from our Snare Support team.