4.0 Understanding License Information

Sentinel comprises a broad spectrum of functionality, which caters to various needs of its many customers. You can choose a licensing model that fulfills your needs.

The Sentinel platform provides the following two licensing models:

  • Sentinel Enterprise: A full-featured solution that enables all the core, real-time visual analytics functions and many additional features. Sentinel Enterprise focuses on SIEM use cases such as real-time threat detection, alerting, and remediation.

  • Sentinel for Log Management: A solution for log management use cases such as the ability to collect, store, search, and report on data.

    Sentinel for Log Management represents a substantial upgrade from the functionality provided in Sentinel Log Manager 1.2.2, and in some cases, significant parts of the architecture have changed. To plan your upgrade to Sentinel for Log Management, see the Sentinel FAQ page.

Depending on the solution(s) and add-ons you purchase, you can buy the appropriate license keys and entitlements to enable the right functionality within Sentinel. Though the license keys and entitlements govern basic access to product features and downloads, you should refer to your purchase agreement and the End-User License Agreement for additional terms and conditions.

The following table outlines the specific services and features available on each of the solutions:

Table 4-1 Sentinel Services and Features

Services and Features

Sentinel Enterprise

Sentinel for Log Management

Core Functionality

  • Event collection, parsing, normalization, and taxonomic classification

  • Non-event data collection (asset data, vulnerability data, and user identity data)

  • In-line contextual mapping

  • Event storage with retention policies and non-repudiation

  • Event routing to traditional storage (internal and external)

  • Event searches and visualization

  • IP Flow collection, storage, and visualization

  • Reporting

  • Federal Information Processing Standard Publication 140-2 (FIPS 140-2) enablement

  • Manually-triggered actions

  • Manual incident creation and management

Yes

Yes

Sentinel Link

Yes

Yes

Data Synchronization

Yes

Yes

Event data restoration from archive

Yes

Yes

Data Federation (distributed search)

Yes

Yes

Exploit Detection (Advisor)*

Yes

Yes

Scalable Storage

Yes

Yes

Correlation

  • Real-time event pattern correlation

  • Actions triggered by correlation rules

  • Alerts triage

  • Alert visualization

Yes

No

Security Intelligence

  • Anomaly rules

  • Real-time statistical analysis

Yes

No

*Advisor, powered by Security Nexus, is an add-on service. You must purchase additional license to use this service.