What are the licensing methods for CrowdStrike Falcon Products that use the Falcon sensor?
CrowdStrike offers four options for licensing products that use the Falcon sensor, note that not all endpoint types are eligible for all licensing options:

In all options, the Falcon sensor is installed on an endpoint. Your account representative can provide more information as to endpoint types.

What is an "endpoint"?
Endpoints are any physical or virtual device, such as a computer, server, laptop, desktop computer, mobile, cellular, container, pod, or virtual machine image. Endpoints are sometimes referred to as workload(s).

When is an endpoint “counted,” “active,” or “consumed”?
An endpoint is counted when the Falcon sensor is installed and has generated a unique agent identifier (also known as an “AID”) and thereafter, when the Falcon sensor has contacted the Falcon platform during the applicable measurement period.

What is a Sensor Subscription License?
A Sensor Subscription License is when you buy a defined number of licenses in advance for a defined period of time (subscription period). The minimum subscription period is one year.

How are endpoints counted against a Sensor Subscription License?
CrowdStrike calculates Sensor Subscription License usage by averaging four consecutive weekly endpoint counts. A weekly endpoint count is determined by counting the total number of endpoints that are consumed for the prior seven days. On a rolling basis, the prior four weekly endpoint counts for each week are added together and divided by four. An endpoint that has the Falcon sensor installed in Week 1 and contacts the Falcon platform during Week 2 is counted in both Week 1 and Week 2. However, if the Falcon sensor installed in Week 1 has no contact with the Falcon platform for the entire Week 2, that Falcon sensor is not counted for Week 2.

Example: If the weekly endpoint count for Week 1 is 30,000 endpoints, Week 2 is 20,000 endpoints, Week 3 is 35,000 endpoints, and Week 4 is 28,000 endpoints, the average would be calculated as follows: (30,000+20,000+35,000+28,000)/4 = 28,250 endpoints.

What constitutes non-compliance under the Sensor Subscription License?
If at any point in time during your subscription, the four-week rolling average of your usage exceeds your licensed quantity, you are out of compliance with your Sensor Subscription License. Non-compliance can be caused by a variety of reasons and may be temporary or sustained.

What are Reserved Hourly Average Sensor Licenses and Reserved Sensor Licenses?
Similar to Sensor Subscription Licenses, Reserved Hourly Average Sensor Licenses and Reserved Sensor Licenses allow you to buy a defined number of licenses in advance for a defined period of time (subscription period), however, the period of measurement for Reserved Hourly Average Sensor Licenses and Reserved Sensor Licenses is a clock-hour. Reserved Hourly Average Sensor Licensing and Reserved Sensor Licensing are specially designed for cloud workloads.

NOTE: If you have a Reserved Hourly Average Sensor License entitlement for a particular customer identification (CID), you cannot add a Reserved Sensor License entitlement to the same CID. If you have an active Reserved Sensor License entitlement and you add a Reserved Hourly Average Sensor License entitlement to the same CID, the Reserved Sensor License entitlement will automatically transition to a Reserved Hourly Average Sensor License entitlement.

If you have purchased a Reserved Hourly Average Sensor License, a Reserved Sensor License, and/or an On-Demand Sensor License, you cannot apply your Sensor Subscription License to endpoint types that are included under a Reserved Hourly Average, Reserved, or On-Demand Sensor License type.

Additionally, if you have purchased under the Reserved Hourly Average Sensor Licensing entitlement for a CID, you cannot make subsequent purchases using the On-Demand Sensor Licensing entitlement for the same CID.

How are endpoints counted against a Reserved Hourly Average Sensor License?
When calculating Reserved Hourly Average Sensor License usage, CrowdStrike counts the number of unique active endpoints that are active for any period of time in each clock-hour and averages them over a rolling 28-day period. The count of Reserved Hourly Average Sensor Licenses re-starts every clock-hour. For example, each Falcon sensor that is active for any amount of time during the period 1:00 to 1:59:59, will count toward the hourly total for that clock-hour. The count will re-start for the period 2:00-2:59:59, and each unique sensor that is active for any amount of time during such period (regardless of whether the sensors are on the same or entirely new endpoints) will count toward the hourly total for that clock-hour. Each endpoint is only counted once in each clock hour. The hourly counts for the prior 28 days (or 672 hours) are added together and divided by 672. The computation is done each day at 0:00 UTC for the previous 28 days. If at any point in time during the rolling 28-day period, your usage exceeds the licensed quantity under your Reserved Hourly Average Sensor License, you will be considered out of compliance with that license.

How are endpoints counted against a Reserved Sensor License?
When calculating Reserved Sensor License usage, CrowdStrike counts the number of active endpoints in each clock-hour. For each endpoint that is active for any period of time in a clock-hour it consumes one license for that clock-hour. The count of a Reserved Sensor License re-starts every clock-hour.

Each clock-hour starts on the hour (zero minutes and zero seconds past the hour) of a Universal Time Coordinated (UTC) 24-hour clock. For example, 1:00 to 1:59:59 is one clock-hour.

Example: If the Falcon sensor is installed on 1,000 public cloud workloads and each sensor is active for any amount of time during the period 1:00 to 1:59:59, each active sensor will consume one Reserved Sensor License for that clock-hour. In the next clock-hour, the count resets to zero. If during the period 2:00-2:59:59, 900 workloads are active, whether they are the same workloads or entirely new ones, each active endpoint sensor will consume one Reserved Sensor License for that clock-hour.

What if usage exceeds the number of Reserved Sensor Licenses purchased in an hour?
You should have an On-Demand Sensor License pre-payment. If you have a Reserved Sensor License and an On-Demand Sensor License, active endpoints are first counted against your Reserved Sensor License quantity in each clock-hour. If in any given clock-hour, your number of active sensors exceeds the Reserved Sensor License quantity, then the excess active sensors will be counted towards your total hourly usage and draw down the On-Demand Sensor License pre-payment.

If you don’t have an On-Demand Sensor License, contact your account representative to maintain license compliance.

What is an On-Demand Sensor License?
An On-Demand Sensor License allows you to pre-pay an amount that can be drawn down based on an hourly rate over a defined license term (minimum is one year). An On-Demand Sensor License gives you the flexibility to scale up and scale down as needed. There are no refunds of pre-payments not used during your subscription period.

How are endpoints counted against an On-Demand Sensor License?
When calculating On-Demand Sensor License usage, CrowdStrike:

Each clock-hour starts on the hour (zero minutes and zero seconds past the hour) of a Universal Time Coordinated (UTC) 24-hour clock. For example, 1:00 to 1:59:59 is one clock-hour. The minimum On-Demand Sensor License increment is one hour. The drawdown of the On-Demand Sensor License pre-payment is considered definitive ten days after the end of the calendar month in which the usage occurred.

Example: If you pre-paid for 5,000 On-Demand Sensor License hours and also licensed 1,000 Reserved Sensor Licenses, all applicable active sensors are counted every clock-hour. If during the period 1:00 to 1:59:59 there are 900 active sensors, there would be no On-Demand Sensor usage that hour as the total sensors did not exceed the Reserved Sensor License quantity. If during the period 2:00 to 2:59:59 there are 1,100 active sensors, there would be 100 hours of On-Demand Sensor License usage consumed because the hourly usage exceeded the Reserved Sensor License quantity by 100 hours. At the end of these two hours, 100 On-Demand Sensor License hours would have been consumed from the 5,000 pre-paid On-Demand Sensor License hours, leaving 4,900 pre-paid On-Demand Sensor License hours remaining.

What if usage exceeds the On-Demand Sensor License pre-payment?
If your usage exhausts your pre-payment, you will continue to incur fees for each hour you exceed your Reserved Sensor License quantity. The overage will be deducted from your new pre-paid amount. You cannot apply newly purchased Reserved Sensor Licenses to reach compliance with historical overages of your pre-payment. Contact your account representative before you exhaust your pre-payment to either purchase more Reserved Sensor Licenses or refill your pre-payment.