CrowdStrike Licensing Metrics & FAQs

CrowdStrike’s primary licensing model for CrowdStrike Falcon Products that use the Falcon sensor is by the number of sensors on endpoints.

CrowdStrike offers four options for licensing products by sensor and endpoint.  Note that not all endpoint types are eligible for all licensing options:

●      Sensor Subscription License

●      Falcon^® Cloud Security – Reserved – Hourly Average Sensor License ("Reserved Hourly Average Sensor License")

●      Falcon^® Cloud Security – Reserved Sensor License ("Reserved Sensor License")

●      On-Demand Sensor License

In all options, the Falcon sensor is installed on an endpoint. Your account representative can provide more information as to endpoint types.

Note that certain Offerings that may be sold by endpoint may also have additional restrictions.  For example, Falcon Long Term Repository (fka Humio Cloud for Falcon) is licensed by the endpoint, with the limitation that only data from CrowdStrike products, (e.g., Falcon^® Insight XDR) can be ingested into Falcon LogScale.

What is an "endpoint"?
Endpoints are any physical or virtual device, such as a computer, server, laptop, desktop computer, mobile, cellular, container, pod, or virtual machine image. Endpoints are sometimes referred to as workload(s).

When is an endpoint "counted," "active," or "consumed"?
An endpoint is counted when the Falcon sensor is installed and has generated a unique agent identifier (also known as an "AID") and thereafter, when the Falcon sensor has contacted the Falcon platform during the applicable measurement period.

What is a Sensor Subscription License?
A Sensor Subscription License is when you buy a defined number of licenses in advance for a defined period of time (subscription period/term). The minimum subscription period is one year.

What are some offerings that are licensed by Subscription Sensor License?
Examples of offerings that leverage the Subscription Sensor License include Falcon^® Prevent, Falcon^® Insight XDR, Falcon^® Search Retention, Falcon^® Device Control, Falcon^® Firewall Management, Falcon^®Threat Graph, Falcon^® Server Threat Graph, Falcon^® for Mobile, Falcon^® Complete for Next-Gen Managed Detection and Response, Falcon^® Complete Identity Threat Protection, Falcon^® OverWatch: Managed Threat Hunting, Falcon^® Adversary OverWatch Cloud, Falcon^® Adversary Intelligence, Falcon^® Adversary Intelligence Premium, Falcon^® Intelligence, Falcon^® Intelligence Premium, Falcon^® Intelligence Recon, Falcon^® Intelligence Recon+, Falcon^® Discover, Falcon^® Spotlight, Falcon^® FileVantage, Falcon^® Forensics, Falcon^® Exposure Management, Falcon^® for IT, Falcon® Surface, Falcon^® Data Protection, and Falcon® AIDR for Workforce.

How are endpoints counted against a Sensor Subscription License?
CrowdStrike calculates Sensor Subscription License usage by averaging four consecutive weekly endpoint counts. A weekly endpoint count is determined by counting the total number of endpoints that are consumed for the prior seven days. On a rolling basis, the prior four weekly endpoint counts for each week are added together and divided by four. An endpoint that has the Falcon sensor installed in Week 1 and contacts the Falcon platform during Week 2 is counted in both Week 1 and Week 2. However, if the Falcon sensor installed in Week 1 has no contact with the Falcon platform for the entire Week 2, that Falcon sensor is not counted for Week 2.

Example: If the weekly endpoint count for Week 1 is 30,000 endpoints, Week 2 is 20,000 endpoints, Week 3 is 35,000 endpoints, and Week 4 is 28,000 endpoints, the average would be calculated as follows: (30,000+20,000+35,000+28,000)/4 = 28,250 endpoints.

What are Reserved Hourly Average Sensor Licenses and Reserved Sensor Licenses?
Similar to Sensor Subscription Licenses, Reserved Hourly Average Sensor Licenses and Reserved Sensor Licenses allow you to buy a defined number of licenses in advance for a defined period of time (subscription period), however, the period of measurement for Reserved Hourly Average Sensor Licenses and Reserved Sensor Licenses is a clock-hour. Reserved Hourly Average Sensor Licensing and Reserved Sensor Licensing are specially designed for cloud workloads.

NOTE: If you have a Reserved Hourly Average Sensor License entitlement for a particular customer identification (CID), you cannot add a Reserved Sensor License entitlement to the same CID. If you have an active Reserved Sensor License entitlement and you add a Reserved Hourly Average Sensor License entitlement to the same CID, the Reserved Sensor License entitlement will automatically transition to a Reserved Hourly Average Sensor License entitlement.

If you have purchased a Reserved Hourly Average Sensor License, a Reserved Sensor License, and/or an On-Demand Sensor License, you cannot apply your Sensor Subscription License to endpoint types that are included under a Reserved Hourly Average, Reserved, or On-Demand Sensor License type.

Additionally, if you have purchased under the Reserved Hourly Average Sensor Licensing entitlement for a CID, you cannot make subsequent purchases using the On-Demand Sensor Licensing entitlement for the same CID.

What are some offerings that are licensed by Reserved Sensor License?
Examples of offerings that leverage the Reserved Sensor License include Falcon^® Cloud Security, Falcon^® Cloud Security with Containers, Falcon^® Cloud Detection and Response, and Falcon^® Cloud & Container Detection and Response.

How are endpoints counted against a Reserved Hourly Average Sensor License?
When calculating Reserved Hourly Average Sensor License usage, CrowdStrike counts the number of unique active endpoints that are active for any period of time in each clock-hour and averages them over a rolling 28-day period. The count of Reserved Hourly Average Sensor Licenses re-starts every clock-hour. For example, each Falcon sensor that is active for any amount of time during the period 1:00 to 1:59:59, will count toward the hourly total for that clock-hour. The count will re-start for the period 2:00-2:59:59, and each unique sensor that is active for any amount of time during such period (regardless of whether the sensors are on the same or entirely new endpoints) will count toward the hourly total for that clock-hour. Each endpoint is only counted once in each clock hour. The hourly counts for the prior 28 days (or 672 hours) are added together and divided by 672. The computation is done each day at 0:00 UTC for the previous 28 days.

How are endpoints counted against a Reserved Sensor License?
When calculating Reserved Sensor License usage, CrowdStrike counts the number of active endpoints in each clock-hour. For each endpoint that is active for any period of time in a clock-hour it consumes one license for that clock-hour. The count of a Reserved Sensor License re-starts every clock-hour.

Each clock-hour starts on the hour (zero minutes and zero seconds past the hour) of a Universal Time Coordinated (UTC) 24-hour clock. For example, 1:00 to 1:59:59 is one clock-hour.

Example: If the Falcon sensor is installed on 1,000 public cloud workloads and each sensor is active for any amount of time during the period 1:00 to 1:59:59, each active sensor will consume one Reserved Sensor License for that clock-hour. In the next clock-hour, the count resets to zero. If during the period 2:00-2:59:59, 900 workloads are active, whether they are the same workloads or entirely new ones, each active endpoint sensor will consume one Reserved Sensor License for that clock-hour.

What if usage exceeds the number of Reserved Sensor Licenses purchased in an hour?
You should have an On-Demand Sensor License pre-payment. If you have a Reserved Sensor License and an On-Demand Sensor License, active endpoints are first counted against your Reserved Sensor License quantity in each clock-hour. If in any given clock-hour, your number of active sensors exceeds the Reserved Sensor License quantity, then the excess active sensors will be counted towards your total hourly usage and draw down the On-Demand Sensor License pre-payment.

If you don’t have an On-Demand Sensor License, contact your account representative to maintain license compliance.

What is an On-Demand Sensor License?
An On-Demand Sensor License allows you to pay an amount based on an hourly rate over a defined license term (minimum is one year). An On-Demand Sensor License gives you the flexibility to scale up and scale down as needed. 

What are some offerings that use the On-Demand Sensor License?
An example of an offering that uses the On-Demand Sensor License is CrowdStrike Falcon^® Managed Containers.

How are endpoints counted against an On-Demand Sensor License?
When calculating On-Demand Sensor License usage, CrowdStrike:

●      Counts the number of active endpoints in each clock-hour – each active endpoint consumes an hour. If you have a Reserved Sensor License, the endpoints are first counted against your Reserved Sensor License quantity. If you don’t have a Reserved Sensor License or your usage exceeds your Reserved Sensor License quantity, then,

●      Multiplies the total number of hours (active endpoints) by the applicable hourly rate,

Each clock-hour starts on the hour (zero minutes and zero seconds past the hour) of a Universal Time Coordinated (UTC) 24-hour clock. For example, 1:00 to 1:59:59 is one clock-hour. The minimum On-Demand Sensor License increment is one hour.

How does a Pre-Paid, On-Demand Sensor License work?

A pre-paid, On-Demand Sensor License subtracts the total dollar amount from the pre-payment.

There are no refunds of pre-payments not used during your subscription period. The drawdown of the On-Demand Sensor License pre-payment is considered definitive ten days after the end of the calendar month in which the usage occurred.

If your usage exhausts your pre-payment, you will continue to incur fees for each hour you exceed your Reserved Sensor License quantity. The overage will be deducted from your new pre-paid amount. You cannot apply newly purchased Reserved Sensor Licenses to reach compliance with historical overages of your pre-payment. Contact your account representative before you exhaust your pre-payment to either purchase more Reserved Sensor Licenses or refill your pre-payment.

A pre-paid, On-Demand Sensor License may be used to maintain license compliance with your Reserved Sensor License quantity.  Consider the following example.  If you pre-paid for 5,000 On-Demand Sensor License hours and also licensed 1,000 Reserved Sensor Licenses, all applicable active sensors are counted every clock-hour. If during the period 1:00 to 1:59:59 there are 900 active sensors, there would be no On-Demand Sensor usage that hour as the total sensors did not exceed the Reserved Sensor License quantity. If during the period 2:00 to 2:59:59 there are 1,100 active sensors, there would be 100 hours of On-Demand Sensor License usage consumed because the hourly usage exceeded the Reserved Sensor License quantity by 100 hours. At the end of these two hours, 100 On-Demand Sensor License hours would have been consumed from the 5,000 pre-paid On-Demand Sensor License hours, leaving 4,900 pre-paid On-Demand Sensor License hours remaining.

How does the Pay-As-You-Go On-Demand Sensor License work?

A pay-as-you-go offering is measured on a consumption basis with no advance purchase or subscription period.  Customers are billed in arrears according to the terms and rates specified in their order, based on the number of active endpoints in each clock hour.  Offerings that use this licensing model include Falcon^® Cloud Security purchased through an AWS Marketplace public offer.

The Charlotte AI Module Entitlement Is licensed by credits, with initial Monthly Credit Cap based on number of sensors purchased.

The Charlotte AI Module access SKU grants customer credits for use in all Charlotte AI features, including AI Chat, Embedded Features (e.g. Command-line analysis, Investigate via Incident Workbench), Agentic Workflows (via Fusion SOAR), AgentWorks (once available), Agentic Detection Triage, and Agentic Response. Charlotte AI licensed by credits per calendar month ("Monthly Credit Cap"). The Monthly Credit Cap resets on the first day of each calendar month; unused credits do not carry over. Charlotte AI Module Customers are entitled to an initial Monthly Credit Cap based on the number of endpoints licensed and the following bands (1-149 endpoints: 40 credits/month, 150-299 endpoints:60 credits/month, 300-499 endpoints: 80 credits/month, 500-749 endpoints: 125 credits/month,750-999 endpoints: 200 credits/month,1,000-1,499 endpoints: 300 credits/month, 1,500-1,999 endpoints: 400 credits/month, 2,000-2,499 endpoints: 450 credits/month, 2,500-4,999 endpoints: 500 credits/month, 5,000-9,999 endpoints: 875 credits/month, 10,000-24,999 endpoints: 1,500 credits/month, 25,000-49,999 endpoints: 3,000 credits/month, 50,000-99,999 endpoints: 6,000 credits/month, 100,000-249,999 endpoints: 12,500 credits/month, 250,000-499,999 endpoints: 25,000 credits/month, 500,000-999,999 endpoints: 50,000 credits/month, 1,000,000 or more endpoints: 77,500 credits/month). Additional credits for the Charlotte AI Module can be purchased in packs of 350.

Additionally, certain Falcon Platform Customers may receive a number of free credits to use a limited set of Charlotte AI Platform Entitlement features, including AI Chat, Embedded Features (e.g. Command-line analysis, Investigate via Incident Workbench), Agentic Workflows (via Fusion SOAR), and AgentWorks (once available). 

How are Charlotte AI Credits Calculated and Consumed?

Charlotte AI is licensed by credits per calendar month ("Monthly Credit Cap"). The Monthly Credit Cap resets on the first day of each calendar month; unused credits do not carry over. Credits are consumed whenever Charlotte AI performs a task.  Generally, a simple query or prompt will consume up to one credit and more complicated and/or multi-step tasks (such as Agentic Response) will consume 1, 3 or 6 credits before potentially requiring additional authorization from the user for additional consumption. Actual credit consumption is calculated by CrowdStrike and the rate for specific Charlotte AI tasks is generally specified in the Falcon UI. Note that for the Charlotte AI Module Entitlement, Charlotte AI automatically triages all Falcon Insight endpoint detections. Detection triage does not consume customer credits. If the Monthly Credit Cap is reached in a calendar month, Charlotte AI will not accept additional tasks unless additional Charlotte AI Usage credits are licensed.

Falcon^® Exposure Management (FEM) Customers are entitled to licenses to assess vulnerabilities on unmanaged assets based on the quantity of FEM licenses licensed.

Falcon^® Exposure Management is licensed per endpoint.  Customers are then entitled to a certain number of free licenses to assess vulnerabilities on unmanaged assets based on the quantity of FEM licenses licensed, based on the following tiers.  100 to 149 FEM Licenses: 10 Unmanaged assets, 150 to 299 FEM Licenses: 15 Unmanaged assets, 300 to 499 FEM Licenses: 30 Unmanaged assets, 500 to 749 FEM Licenses: 50 Unmanaged assets, 750 to 999 FEM Licenses: 75 Unmanaged assets, 1,000 to 1,499 FEM Licenses: 100 Unmanaged assets, 1,500 to 1,999 FEM Licenses: 150 Unmanaged assets, 2,000 to 2,499 FEM Licenses: 200 Unmanaged assets, 2,500 to 4,999 FEM Licenses: 250 Unmanaged assets, 5,000 to 9,999 FEM Licenses: 500 Unmanaged assets, 10,000 to 24,999 FEM Licenses: 1,000 Unmanaged assets, 25,000 to 49,999 FEM Licenses: 2,500 Unmanaged assets, 50,000 to 99,999 FEM Licenses: 5,000 Unmanaged assets, 100,000 or more FEM Licenses: 10,000 Unmanaged assets.

Some Offerings are licensed by the total number of Active accounts. 
“Active” means accounts that have authenticated in the last 90 days (at any point in time during the subscription in the last ninety days). If an account has authenticated in the 90 days before the measurement, then it is considered active. What is counted is the overall sum of active accounts (no average).  “Accounts” means human accounts and service accounts.  Hybrid Accounts (e.g., those from on-prem AD, synced with Azure via AzureAD connect) consume a single license, despite the user technically having an account in on-prem and AzureAD. 

What are some examples of offerings that leverage account-based licensing models?
Examples of offerings leveraging an account-based licensing model include Falcon^® Identity Threat Detection, Falcon Privileged Access, Falcon Next-Gen Identity Security, Falcon^® Adversary OverWatch Identity, and Falcon^® Identity Threat Protection. Licensing is based on all active accounts on the domains in the customer environment where Falcon^® Identity Threat Detection and Falcon^® Identity Threat Protection are deployed. A subset of accounts cannot be licensed.

How is Falcon^® Shield licensed?
Falcon^® Shield is licensed by the number of cloud users, which is calculated by counting the largest number of users in any customer cloud directory. There are two available SKUs: one covering up to 10 applications, and another providing unlimited coverage.

How is Falcon^® Discover IOT licensed?
Falcon^® Discover IOT is licensed by the number of “Assets.”  “Assets” means the number of devices (including managed, unmanaged, and unsupported devices) in the customer’s Industrial Control Systems (ICS) environment. This is measured once per quarter, on the last day of each quarter.

How is Falcon^® ASPM licensed?
Falcon^® ASPM is licensed by the  number of “Services.”  A “Service” is any component or object that can initiate, receive, or process data requests.  Falcon^® ASPM is licensed by the number of unique Services discovered by analyzing a customer’s environments. A Service is only counted once regardless of how many duplicate instances of an identified Service are discovered.

What is a licensing model based on data ingestion and storage?
Data ingestion-based offerings are licensed according to (i) the volume of data ingested and (ii) in some cases, the period of time data is retained or the number of licenses purchased. The method for calculating the amount of data ingested is set forth in the applicable product documentation.

What are some examples of offerings that leverage data ingestion-based licensing  models?
Examples of data ingestion-based offerings that are licensed based only on volume of data ingested include Falcon^® Complete Next-Gen SIEM, Falcon^® Complete Next-Gen SIEM Upgrade,and Falcon^® LogScale Complete (fka Humio Complete) and CrowdStrike-Onum. An example of a data ingestion-based offerings that is licensed based on volume of data ingested and the number of licenses purchased is Falcon^® LogScale Self Hosted (fka Humio Self Hosted); the Customer can install only a single instance of the product purchased (unless otherwise specified explicitly in the order), and must also comply with the licensed ingestion limit. Examples of data ingestion-based offerings that are licensed based on volume of data ingested and the period of time the data is retained include Falcon^® Next-Gen SIEM, Falcon^® Next-Gen SIEM Retention (count must align with the Falcon^® Next-Gen SIEM entitlement), and Falcon^® LogScale Cloud (fka Humio Cloud). 

What happens if usage exceeds limitations or quantities licensed for Data Ingestion-Based Licenses?
If data volumes exceed the licensed ingestion amount, customers will be notified and may be prevented from additional ingestion.

How does a Pay-As-You-Go Ingestion-Based License work?
A pay-as-you go offering is measured on consumption with no advance purchase or subscription period. Customers are billed in arrears according to the terms and rates specified in their order, based on the volume of data actually ingested. Offerings that use this licensing model include Falcon® Next-Gen SIEM customers purchasing through an AWS Marketplace public offer.

How does CrowdStream licensing work?
CrowdStream is also licensed by the number of gigabytes of data ingested daily, where a quantity of one equals 100 gigabytes of data ingested daily.  CrowdStrike Falcon platform customers receive up to 10 gigabytes of daily streaming data at no additional cost.

How is Falcon^® Sandbox licensed?
Falcon^® Sandbox is licensed based on the band of number of files processed per month (e.g., up to 1,000 files/month).

How is Falcon^® MalQuery licensed?
Falcon^® MalQuery is licensed based on the band of number of searches run per month (e.g., up to 5 searches per month).

How is Falcon^® QuickScan ML licensed?
Falcon^® QuickScan ML and Falcon^® QuickScan Pro are licensed based on the band of number of files processed per month (e.g., up to 25,000 files/month).

How is Falcon^® Intelligence Expansion Pack licensed?
Falcon^® Intelligence Expansion Pack is licensed based on the band of number of files processed per month (e.g., up to 25,000 files/month).

How is Falcon^® AIDR for Agents licensed?
Falcon^® AIDR for Agents is licensed by the combined number of prompts, responses, and other AI Inputs/Outputs (“I/O”) processed through the product per day (e.g., up to 10,000 I/O per day). Usage is calculated as average daily I/O volume over the preceding 30 days, based on the UTC timezone.  I/Os may be generated by persons or agents, and I/Os that exceed 10KB will count as one (1) I/O per 10KB.

What does the Falcon Plus Bundle A license include?

In the Commercial Clouds: Falcon Plus Bundle A entitles customers to: 100 endpoints of Falcon Prevent, Insight, Device Control, Firewall Management, Discover, Threat Graph Standard, Falcon Adversary OverWatch Endpoint, and Falcon Complete Upgrade; 30 endpoints of Server Threat Graph Standard; 125 Accounts of Identity Threat Protection, Falcon Adversary OverWatch Identity, and Identity Threat Protection Complete Upgrade; 25 endpoints of Falcon Cloud Security Runtime Protection, Falcon Adversary OverWatch Cloud, and Falcon Cloud Security Complete Upgrade; 5 endpoints of Falcon Cloud Security with Containers Runtime Protection, Falcon Adversary OverWatch Cloud Containers, and Falcon Complete Upgrade with Container; 10 GB/day of Falcon Next-Gen SIEM 365 Day Retention and Falcon Adversary Overwatch Next Gen-SIEM; and Express Support.

In Gov Cloud: Falcon Plus Bundle A entitles customers to: 100 endpoints of Falcon Prevent, Insight, Device Control, Firewall Management, Discover, Threat Graph Standard on GovCloud, Falcon Adversary OverWatch Endpoint, and Falcon Complete Upgrade on Gov Cloud; 30 endpoints of Server Threat Graph Standard on GovCloud; 125 Accounts of Identity Threat Protection, Falcon Adversary OverWatch Identity, and Identity Threat Protection Complete Upgrade on GovCloud; 25 endpoints of Falcon Cloud Security Runtime Protection, Falcon Adversary OverWatch Cloud, and Falcon Cloud Security Complete Upgrade on Gov Cloud; 5 endpoints of Falcon Cloud Security with Containers Runtime Protection, Falcon Adversary OverWatch Cloud Containers, and Falcon Complete Upgrade with Container on Gov Cloud; 10 GB/day of Falcon Next-Gen SIEM 365 Day Retention; and Express Support.

What does the Falcon Plus Bundle B license include?

In the Commercial Clouds: Falcon Plus Bundle B entitles customers to: 250 endpoints of Falcon Prevent, Insight, Device Control, Firewall Management, Discover, Threat Graph Standard, Falcon Adversary OverWatch Endpoint, and Falcon Complete Upgrade; 60 endpoints of Server Threat Graph Standard; 300 Accounts of Identity Threat Protection, Falcon Adversary OverWatch Identity, and Identity Threat Protection Complete Upgrade; 50 endpoints of Falcon Cloud Security Runtime Protection, Falcon Adversary OverWatch Cloud, and Falcon Cloud Security Complete Upgrade; 10 endpoints of Falcon Cloud Security with Containers Runtime Protection, Falcon Adversary OverWatch Cloud Containers, and Falcon Complete Upgrade with Container; 10 GB/day of Falcon Next-Gen SIEM 365 Day Retention and Falcon Adversary Overwatch Next Gen-SIEM; and Express Support.

In Gov Cloud: Falcon Plus Bundle B entitles customers to: 250 endpoints of Falcon Prevent, Insight, Device Control, Firewall Management, Discover, Threat Graph Standard on GovCloud, Falcon Adversary OverWatch Endpoint, and Falcon Complete Upgrade on Gov Cloud; 60 endpoints of Server Threat Graph Standard on GovCloud; 300 Accounts of Identity Threat Protection, Falcon Adversary OverWatch Identity, and Identity Threat Protection Complete Upgrade on GovCloud; 50 endpoints of Falcon Cloud Security Runtime Protection, Falcon Adversary OverWatch Cloud, and Falcon Cloud Security Complete Upgrade on Gov Cloud; 10 endpoints of Falcon Cloud Security with Containers Runtime Protection, Falcon Adversary OverWatch Cloud Containers, and Falcon Complete Upgrade with Container on Gov Cloud; 10 GB/day of Falcon Next-Gen SIEM 365 Day Retention; and Express Support.

What does the Falcon Plus Bundle C license include?

In the Commercial Clouds: Falcon Plus Bundle C entitles customers to: 500 endpoints of Falcon Prevent, Insight, Device Control, Firewall Management, Discover, Threat Graph Standard, Falcon Adversary OverWatch Endpoint, and Falcon Complete Upgrade; 120 endpoints of Server Threat Graph Standard; 625 Accounts of Identity Threat Protection, Falcon Adversary OverWatch Identity, and Identity Threat Protection Complete Upgrade; 100 endpoints of Falcon Cloud Security Runtime Protection, Falcon Adversary OverWatch Cloud, and Falcon Cloud Security Complete Upgrade; 20 endpoints of Falcon Cloud Security with Containers Runtime Protection, Falcon Adversary OverWatch Cloud Containers, and Falcon Complete Upgrade with Container; 10 GB/day of Falcon Next-Gen SIEM 365 Day Retention and Falcon Adversary Overwatch Next Gen-SIEM; and Express Support.

In Gov Cloud: Falcon Plus Bundle C entitles customers to: 500 endpoints of Falcon Prevent, Insight, Device Control, Firewall Management, Discover, Threat Graph Standard on GovCloud, Falcon Adversary OverWatch Endpoint, and Falcon Complete Upgrade on Gov Cloud; 120 endpoints of Server Threat Graph Standard on GovCloud; 625 Accounts of Identity Threat Protection, Falcon Adversary OverWatch Identity, and Identity Threat Protection Complete Upgrade on GovCloud; 100 endpoints of Falcon Cloud Security Runtime Protection, Falcon Adversary OverWatch Cloud, and Falcon Cloud Security Complete Upgrade on Gov Cloud; 20 endpoints of Falcon Cloud Security with Containers Runtime Protection, Falcon Adversary OverWatch Cloud Containers, and Falcon Complete Upgrade with Container on Gov Cloud; 10 GB/day of Falcon Next-Gen SIEM 365 Day Retention; and Express Support.

What does the Falcon Plus Bundle D license include?

In the Commercial Clouds: Falcon Plus Bundle D entitles customers to: 100 endpoints of Falcon Prevent, Insight, Device Control, Firewall Management, Discover, Threat Graph Standard, and Falcon Adversary OverWatch Endpoint; 30 endpoints of Server Threat Graph Standard; 125 Accounts of Identity Threat Protection, and Falcon Adversary OverWatch Identity; 25 endpoints of Falcon Cloud Security Runtime Protection, and Falcon Adversary OverWatch Cloud; 5 endpoints of Falcon Cloud Security with Containers Runtime Protection, and Falcon Adversary OverWatch Cloud Containers; 10 GB/day of Falcon Next-Gen SIEM 365 Day Retention and Falcon Adversary Overwatch Next Gen-SIEM; and Express Support.

In Gov Cloud: Falcon Plus Bundle D entitles customers to: 100 endpoints of Falcon Prevent, Insight, Device Control, Firewall Management, Discover, Threat Graph Standard on GovCloud, and Falcon Adversary OverWatch Endpoint; 30 endpoints of Server Threat Graph Standard on GovCloud; 125 Accounts of Identity Threat Protection, and Falcon Adversary OverWatch Identity; 25 endpoints of Falcon Cloud Security Runtime Protection, and Falcon Adversary OverWatch Cloud; 5 endpoints of Falcon Cloud Security with Containers Runtime Protection, and Falcon Adversary OverWatch Cloud Containers; 10 GB/day of Falcon Next-Gen SIEM 365 Day Retention; and Express Support.

What does the Falcon Plus Bundle E license include?

In the Commercial Clouds: Falcon Plus Bundle E entitles customers to: 250 endpoints of Falcon Prevent, Insight, Device Control, Firewall Management, Discover, Threat Graph Standard, and Falcon Adversary OverWatch Endpoint; 60 endpoints of Server Threat Graph Standard; 300 Accounts of Identity Threat Protection, and Falcon Adversary OverWatch Identity; 50 endpoints of Falcon Cloud Security Runtime Protection, and Falcon Adversary OverWatch Cloud; 10 endpoints of Falcon Cloud Security with Containers Runtime Protection, and Falcon Adversary OverWatch Cloud Containers; 10 GB/day of Falcon Next-Gen SIEM 365 Day Retention and Falcon Adversary Overwatch Next Gen-SIEM; and Express Support.

In Gov Cloud: Falcon Plus Bundle E entitles customers to: 250 endpoints of Falcon Prevent, Insight, Device Control, Firewall Management, Discover, Threat Graph Standard on GovCloud, and Falcon Adversary OverWatch Endpoint; 60 endpoints of Server Threat Graph Standard on GovCloud; 300 Accounts of Identity Threat Protection, and Falcon Adversary OverWatch Identity; 50 endpoints of Falcon Cloud Security Runtime Protection, and Falcon Adversary OverWatch Cloud; 10 endpoints of Falcon Cloud Security with Containers Runtime Protection, and Falcon Adversary OverWatch Cloud Containers; 10 GB/day of Falcon Next-Gen SIEM 365 Day Retention; and Express Support.

What does the Falcon Plus Bundle F license include?

In the Commercial Clouds: Falcon Plus Bundle F entitles customers to: 500 endpoints of Falcon Prevent, Insight, Device Control, Firewall Management, Discover, Threat Graph Standard, and Falcon Adversary OverWatch Endpoint; 120 endpoints of Server Threat Graph Standard; 625 Accounts of Identity Threat Protection, and Falcon Adversary OverWatch Identity; 100 endpoints of Falcon Cloud Security Runtime Protection, and Falcon Adversary OverWatch Cloud; 20 endpoints of Falcon Cloud Security with Containers Runtime Protection, and Falcon Adversary OverWatch Cloud Containers; 10 GB/day of Falcon Next-Gen SIEM 365 Day Retention and Falcon Adversary Overwatch Next Gen-SIEM; and Express Support.

In Gov Cloud: Falcon Plus Bundle F entitles customers to: 500 endpoints of Falcon Prevent, Insight, Device Control, Firewall Management, Discover, Threat Graph Standard on GovCloud, and Falcon Adversary OverWatch Endpoint; 120 endpoints of Server Threat Graph Standard on GovCloud; 625 Accounts of Identity Threat Protection, and Falcon Adversary OverWatch Identity; 100 endpoints of Falcon Cloud Security Runtime Protection, and Falcon Adversary OverWatch Cloud; 20 endpoints of Falcon Cloud Security with Containers Runtime Protection, and Falcon Adversary OverWatch Cloud Containers; 10 GB/day of Falcon Next-Gen SIEM 365 Day Retention; and Express Support.