CrowdStrike Sensor Licensing
Endpoints are any physical or virtual device, such as, a computer, server, laptop, desktop computer, mobile, cellular, container, pod, or virtual machine image. Endpoints are sometimes referred to as workload(s).
An Endpoint is counted when the Falcon sensor is installed and has generated a unique agent identifier and thereafter, when the Falcon sensor has contacted the Falcon Platform during the applicable measurement period.
A Subscription Sensor License is when you buy a defined number of licenses in advance for a defined period of time (subscription period). The minimum subscription period is one year.
All Endpoint types can be licensed under a Subscription Sensor License. For Falcon Endpoint Protection Products, devices with client operating systems, including laptops, desktops, servers, workstations and mobile devices, may only be licensed under a Subscription Sensor License.
CrowdStrike calculates subscription license usage by averaging four consecutive weekly Endpoint counts. A weekly Endpoint count is determined by counting the total number of Endpoints that are consumed for the prior seven days. On a rolling basis, the prior four weekly Endpoint counts for each week are added together and divided by four. An Endpoint that has the Falcon sensor installed in Week 1 and contacts the Falcon Platform during Week 2 is counted in both Week 1 and Week 2. However, if the Falcon sensor installed in Week 1 has no contact with the Falcon Platform for the entire Week 2, that Falcon sensor is not counted for Week 2.
Example: If the weekly Endpoint count for Week 1 is 30,000 Endpoints, Week 2 is 20,000 Endpoints, Week 3 is 35,000 Endpoints, and Week 4 is 28,000 Endpoints, the average would be calculated as follows: (30,000+20,000+35,000+28,000)/4 = 28,250 Endpoints.
An On-Demand Sensor License allows you to pre-pay an amount that can be drawn down based on an hourly rate over a defined license term (minimum is one year). An On-Demand Sensor License gives you the flexibility to scale up and scale down as needed. There are no refunds of pre-payments not used during your license term.
- Public cloud workloads which are Endpoints in AWS, GCP or Azure; and/or
- Containers when:
- CrowdStrike Container Security is installed, and
- the underlying operating system (OS) is locked down over the entire pod, and
- the container is running in a private cloud, public cloud, on-premise, or in a hybrid environment.
An example of a locked down OS, is a serverless container environment like AWS Fargate. CrowdStrike Container Security is designed to work with a Kubernetes deployment and only requires a single Falcon Container within a pod. In this situation, the pod would be counted as one Endpoint.
At this time, CrowdStrike Container Security workloads are the only kind of Endpoint outside the public cloud that can be used under an On-Demand License.
When calculating on-demand license usage, CrowdStrike:
- Counts the number of active Endpoints in each clock hour – each active Endpoint consumes an hour.
- Multiply the total number of hours (active Endpoints) by the applicable hourly rate,
- Subtract the total dollar amount from the pre-payment.
Each clock-hour starts on the hour (zero minutes and zero seconds past the hour) of a Universal Time Coordinated (UTC) 24-hour clock. For example, 1:00 to 1:59 is one clock-hour. The minimum on-demand license increment is one hour. If your usage exceeds your pre-payment, additional On-Demand sensor hours consumed will be charged at CrowdStrike’s standard rate monthly in arrears.
Example: If the Falcon sensor is installed on 1,000 workloads and each sensor is active for any amount of time during the period 1:00 to 1:59, each active sensor will consume one hour of On-Demand usage, producing 1,000 total hours for that clock-hour. If during the period 2:00- 2:59 900 workloads are active, whether they are the same workloads or entirely new ones, each active Endpoint sensor will consume one hour of On-Demand usage, producing 1,900 total hours of On-Demand usage in two hours.
Yes! Public cloud Endpoints that run consistently over several clock hours are sometimes referred to as “reserved”. You may be able to save on CrowdStrike On-Demand usage costs by purchasing a Reserved License for those reserved Endpoints. Any new or existing Endpoints active in each clock-hour are automatically applied to your Reserved Sensor License until all Reserved licenses have been exhausted.
The same Endpoint types that apply to an On-Demand Sensor License.
As described above, customers may choose to pre-purchase licenses for public cloud and container Endpoints in the form of a Reserved Sensor License. If you have both a Reserved Sensor License and an On-Demand Sensor License, license usage is counted using the On-Demand methodology described above, however, active Endpoints are first counted against your Reserved Sensor License quantity in each clock hour.
You can run up to the total number of Reserved Sensor Licenses every clock hour without incurring any On-Demand usage or drawing down the On-Demand License pre-payment. If your number of active sensors exceeds the Reserved Sensor License quantity, then the excess active sensors will be counted towards your total hourly usage and draw down the On-Demand Sensor License pre-payment.
Example: If you pre-paid for 5,000 On-Demand Sensor License hours and also licensed 1,000 Reserved Sensor Licenses, all applicable active sensors are counted every clock-hour using the On-Demand methodology. If during the period 1:00 to 1:59 there are 900 active sensors, there would be no On-Demand usage that hour as the total sensors did not exceed the Reserved Sensor License quantity. If during the period 2:00 to 2:59 there are 1,100 active sensors, there would be 100 hours of On-Demand usage consumed since the hourly usage exceeded the Reserved Sensor License quantity by 100 hours.
At the end of these two hours, 100 On-Demand sensor hours would have been consumed from the 5,000 pre-paid On-Demand License hours, leaving 4,900 pre-paid On-Demand Sensor hours remaining.