Licensing

Rockfish NDR uses Ed25519-signed license files for offline-verifiable feature gating.

Tiers

Basic and Professional share nearly the entire feature set — core panels, Hunt, Asset Inventory, signing, webhooks and per-segment reports are included in both. Professional adds the ML-driven detection lenses (Anomaly and Behavioral) and a higher events-per-minute ceiling (10K → 60K). Enterprise adds a few exclusive features (detection swimlane + topology graph, custom branding, MQTT/Kafka, external threat intel) and lifts every capacity cap.

See License Tiers for the full feature matrix.

Every Tier Requires a License

There is no unlicensed mode. Every tier — including Basic — requires a valid, signed license file to run. The Basic license is $0 but still requires registration to obtain. Without a valid license the engine refuses to start (the only exceptions are utility commands such as rockfish config / --version and demo report rendering).

The NDR engine re-checks the license once per day while running.

45-Day Professional Trial (Basic)

A Basic license is entitled to the full Professional feature set for its first 45 days (measured from the license issued_at), then automatically reverts to Basic. Professional and Enterprise licenses are unaffected. Because the engine re-checks daily, the reversion takes effect without a restart.

Purchasing & Registration

Licenses are obtained through the Rockfish shop. All tiers require registration first, including Basic. Every license — Basic, Professional, and Enterprise alike — covers one Suricata instance; multiple sensors require multiple licenses.

Installation

scp rockfish-license.json root@sensor:/opt/rockfish/etc/rockfish_license.json
rockfish detect --license /opt/rockfish/etc/rockfish_license.json

Expiry Reminders

Licenses are issued on an annual (per-year) basis with a 30-day grace period past expires_at. Email reminders are sent at 30, 7, 1, and 0 days before expiry. During the grace window the licensed tier remains fully active; after it, the engine stops honoring the expired license — renew before then.

Tier Details

Basic ($0)

Nearly the complete Rockfish feature set:

• Core panels (Overview, Alerts, Applications, DNS, TLS, Hosts, Flows)
• OT protocol decoders, Asset Inventory, OT Protocol Traffic panel
• GeoIP enrichment + world map, IP reputation (AbuseIPDB)
• NIST PQC compliance, Encrypted Traffic Analytics, Performance lens
• Hunt detection (beaconing, lateral, fanout, portscan, community)
• Per-segment sub-reports, Parquet signing, webhook publishing
• S3 backhaul, HTML reports, and full documentation

Capped at 10,000 events/min. Requires free registration.

Professional ($99)

Everything in Basic, plus:

• The ML-driven detection lenses — Anomaly (iForest/HBOS) and Behavioral (SIGMA tactic rules + OCCAM HMM sequence prediction)
• Higher throughput: 60,000 events/min

Enterprise ($999)

• Everything in Basic / Professional
• Unlimited events/min, unlimited network segments
• Detection swimlane + topology graph
• Custom theme + logo, MQTT/Kafka, external threat intel

Deployment

• Runs on your VPC or on-premise
• No telemetry or phone home
• Fully air-gap capable
• Ed25519-signed licenses with provenance metadata included in every Parquet file

License File

Licenses are JSON files with an Ed25519 signature:

{
  "id": "rockfish_acme-corp-enterprise_Abc123",
  "tier": "enterprise",
  "customer_name": "Acme Corp",
  "customer_email": "[email protected]",
  "max_events_per_min": null,
  "issued_at": "2026-01-01T00:00:00Z",
  "expires_at": "2027-01-01T00:00:00Z",
  "signature": "base64-encoded-ed25519-signature"
}

Configuration

Specify the license file on the command line or in YAML config:

# CLI argument
rockfish --license /etc/rockfish/license.json detect

# Or in rockfish.yaml
license: /etc/rockfish/license.json

Verify License

# Show license information with rockfish config
rockfish --license /etc/rockfish/license.json config

Next Steps

• License Tiers - Detailed feature matrix