License Tiers
Detailed feature matrix for Rockfish NDR license tiers. The methods on
NdrTier in ndr/rockfish/crates/rockfish-types/src/license.rs are the
source of truth; this page mirrors them.
Every tier is sold per sensor (one license per Suricata instance) — Enterprise included. All tiers, including Basic, require registration to obtain a signed license; there is no unlicensed mode. See the Rockfish shop for pricing and registration.
Tier Comparison
| Feature | Basic ($0) | Professional ($99) | Enterprise ($999) |
|---|---|---|---|
| Events/min | 10,000 | 60,000 | Unlimited |
| Segments | 8 | 8 | Unlimited |
| Licensing scope | 1 sensor | 1 sensor | 1 sensor |
| Core panels (Overview, Alerts, Applications, DNS, TLS, Hosts, Flows) | Yes | Yes | Yes |
| OT protocol decoders | Yes | Yes | Yes |
| S3 backhaul / Parquet export | Yes | Yes | Yes |
| GeoIP country/ASN enrichment + world map | Yes | Yes | Yes |
| IP reputation (AbuseIPDB) | Yes | Yes | Yes |
| NIST PQC compliance (TLS) | Yes | Yes | Yes |
| Encrypted Traffic Analytics (ETA) | Yes | Yes | Yes |
| Performance lens (odometry) | Yes | Yes | Yes |
| Transport performance (per-flow) | Yes | Yes | Yes |
| Hunt detection (beaconing, lateral, fanout, portscan, community) | Yes | Yes | Yes |
| Asset Inventory page | Yes | Yes | Yes |
| OT Protocol Traffic panel | Yes | Yes | Yes |
| Per-segment sub-reports | Yes | Yes | Yes |
| Parquet signing | Yes | Yes | Yes |
| Webhook publishing | Yes | Yes | Yes |
| Anomaly lens (iForest / HBOS) — ML | — | Yes | Yes |
| Behavioral lens (SIGMA tactics + OCCAM HMM) — ML | — | Yes | Yes |
| Detection swimlane + topology graph | — | — | Yes |
| Custom theme + logo (white-labelling) | — | — | Yes |
| MQTT / Kafka | — | — | Yes |
| External threat-intel feeds | — | — | Yes |
Basic and Professional share nearly the entire feature set. Professional adds the ML-driven detection lenses (Anomaly + Behavioral) and lifts the events/min throughput ceiling (10K → 60K). Enterprise adds the four exclusive rows above and lifts every capacity cap.
Several capabilities (PQC, ETA, Performance, Transport performance) are tier-permissive but data-strict: available at every tier, but the corresponding page or section only renders when the relevant Suricata plugin or processor has actually produced Parquet on disk.
The unified Detections page (combined-risk table + co-firing swimlane) is suppressed when fewer than two detection lenses are active, since it degrades to a worse Alerts view.
Basic ($0)
Nearly the complete Rockfish feature set — core panels, Hunt, Asset Inventory, signing, webhooks, and per-segment reports — throttled to 10,000 events/min over one sensor. The ML-driven Anomaly and Behavioral lenses are Professional+. Requires free registration to obtain a signed license.
45-day Professional trial: a Basic license is entitled to the full
Professional feature set for its first 45 days (from issued_at), then
reverts to Basic. The engine re-checks daily, so reversion needs no restart.
Limit: 10,000 events per minute, 1 sensor.
Professional ($99)
Everything in Basic, plus the ML-driven detection lenses — Anomaly (iForest/HBOS) and Behavioral (SIGMA tactic rules + OCCAM HMM) — and a higher throughput ceiling.
Limit: 60,000 events per minute, 1 sensor.
Enterprise ($999)
Everything in Basic / Professional, plus the Enterprise-only features:
- Detection swimlane + network topology graph
- Custom theme + logo, MQTT/Kafka, external threat-intel feeds
- No event-rate or segment limit
Limit: unlimited events per minute, unlimited segments, 1 sensor.
License File Format
{
"id": "rockfish_acme-corp-enterprise_Abc123",
"tier": "enterprise",
"customer_name": "Acme Corp",
"customer_email": "[email protected]",
"max_events_per_min": null,
"issued_at": "2026-01-01T00:00:00Z",
"expires_at": "2027-01-01T00:00:00Z",
"signature": "base64-encoded-ed25519-signature"
}
Licenses are verified using Ed25519 digital signatures with a public key embedded in the binary. License provenance metadata is included in every Parquet file.
Deployment Model
- Annual (per-year) licenses with a 30-day grace period past
expires_at; software maintenance included for the license term - Per-sensor at every tier, Enterprise included
- Every tier requires a signed license (Basic requires registration)
- Runs on your VPC or on-premise
- No telemetry or phone home
- Fully air-gap capable