Customer portal Licenses and support

FireSight OT licenses

FireSight OT (a Cloud Hub and its Cloud Connectors) is licensed through this same portal, with the same keys and license files as FireSight. Systems, licenses and downloads show which product they are for, and FireSight OT counts Cloud Connectors instead of firewalls.

Two kinds of license

	Hub license	Device license
For	A company that runs a Cloud Hub	One Cloud Connector, for example a device sold with a subscription
Bound to	The Hub (its serial, `OT-XXXX-XXXX-XXXX`, and hardware)	The connector's serial (`CC-XXXX-XXXX-XXXX`), which survives re-flashing
Covers	A number of Cloud Connectors	Exactly one Cloud Connector, on any Hub
Installed	On the Hub's License page, or `fsot-hub license install`	On the Hub, or on the device (`license=` in `firesight.txt`, or `fsot-connector set license`)

License a Cloud Hub

On the Hub, open License and download the activation request.
In the portal, upload it under Register a system, like a FireSight activation request. The portal recognises it as a Cloud Hub and records its customers and connectors.
Ask for a license on the Hub's page, or your reseller or FireSight issues one.
Download the .lic file and install it on the Hub.

On a shared Hub, a license can be meant for one of the Hub's customers. Whoever issues it fills in For a customer on this Hub, and the Hub's administrator assigns it to that customer on the Hub's License page.

Register and license Cloud Connectors

Cloud Connectors are registered by the serial on their label (also shown by fsot-connector status), usually when they're made or sold. FireSight staff, or the customer's reseller, enter one serial per line under Register Cloud Connectors on the customer's page. A serial belongs to one customer.

Each connector then has its own page, where a device license is issued. The customer downloads the .lic file from the portal, or it ships on the device. When a Hub reports a registered connector, its page shows which Hub it's on.

Which license covers a connector

The Hub decides, oldest connector first: a device license for that connector, then a Hub license meant for the connector's customer that still has room, then any other Hub license with room, then the evaluation.

Evaluation, grace and restricted mode

A new Hub runs as a 30-day evaluation for up to 3 Cloud Connectors. A connector that isn't covered (over the count, expired, or after the evaluation) has 30 days of grace. After that, the connector keeps working in a restricted mode: new user sessions through it are refused (web pages, client tunnels, browser sessions, port forwards and VPN routes). Covered connectors aren't affected.

In restricted mode, security and software updates continue, and so do remote management, status, diagnostics, certificate renewal, file storage and installing a new license, so a lapsed license never strands a device.

The Detect add-on

Detect (threat detection on Cloud Connectors, from FireSight OT 0.4.0) is licensed per Cloud Hub: one Detect license covers every Cloud Connector on that Hub, however many there are. It's a separate license file with its own term, PO and renewal, so it can be added to a Hub at any time without changing the Hub's main license.

Get it: customers choose The Detect add-on under Ask for a license on their Cloud Hub's page; FireSight staff issue it from the Hub's Detect add-on card.
See it: the Hub's page shows Detect active to a date, or Detect: not licensed, next to the main license, and the license list shows the Detect license with a Detect tag.
Install it: on the Hub's License page next to the main license, like any other license file. It renews online too.

On the Hub

The Detect license has "kind": "detect" and "features": ["detect"], is bound to the Hub like a Hub license, and has no Cloud Connector count. It doesn't cover Cloud Connectors itself, and on its own it doesn't end the evaluation: Detect is included in the evaluation.

Install it on the Hub's License page (paste or upload), the same way as the main license. The License page shows Detect add-on: Active until …, a grace warning, included in the evaluation or not licensed. Online renewal renews it separately from the main license.

A Hub with a current Detect license fetches new detection rules from the license server once a day. When the Detect license expires, Detect and rule pack updates keep working for 30 days, and the License page shows until when. After that, Detect stops on all Cloud Connectors and the rule server refuses updates. Evaluation Hubs use the rules built into the software. More: Detect: threat detection.

Software updates

A Cloud Hub that can reach FireSight lists new versions itself under Software updates, and its administrator installs them with a click or at a scheduled time; nothing installs by itself. Security fixes are marked, and FireSight e-mails your company's portal administrators when your Hub runs an older version than a security fix. The portal's pages show a banner too.

A Hub without internet access: open the Cloud Hub in the portal (Systems & licenses), download the package for its architecture (amd64 or arm64) under Software updates, and install it in the Hub with Software updates → Install from a file. The Hub checks FireSight's signature before it installs anything.

With a current license you get every update. If the license has expired, security updates still come.

Resellers

A reseller's allowance has separate amounts for FireSight firewalls and FireSight OT Cloud Connectors, and a device license uses one connector from it.

Online renewal

A Hub or connector can fetch its current license from license.firesightsystems.com once a day, if its owner turns online renewal on. It sends the license ID, its install ID or device serial, the number of connectors in use and its version, and gets back the current signed copy.