How Enterprise licensing works

The Enterprise model uses a monthly credit system, providing the flexibility to scale your monitoring up or down throughout the month without losing value.

1. Credit allocation: At the start of the month, you receive credits based on your subscription
2. 1 Path = 30 (days) * 24 (hours) credits.
3. Hourly consumption: We measure active paths every hour and deduct that amount from your credit balance.
4. Overage protection: If you exceed your monthly credit pool, additional monitoring is seamlessly covered at the standard Paygo rate.

Calculation example

If you subscribe to 100 active paths for a 30-day month:

100 { paths} * 30 { days} * 24 { hours} =72,000 { credits}

• Hour 1: Monitor 100 paths , 100 credits used (71,900 remaining).
• Hour 2: Burst to 1,000 paths, 1,000 credits used (70,900 remaining).
• Hour 3: Scale down to 10 paths, 10 credits used (70,890 remaining).

Note: This "burn-down" approach allows you to burst your monitoring during high-traffic events or troubleshooting windows using your pre-purchased capacity.

Pricing example

The following table shows an example usage pattern where you run 100 Connectivity Tests in a single month.

Pricing example

The following table shows an example that assumes that you are running 100 VM instances all day in a single month (730 hours), without including the Internet to Google Cloud metrics.

Pricing example

The following table shows an example that assumes that you are running 100 VM instances all day in a single month (730 hours).

Example

Suppose you have a project with two VPC networks, each containing 100 firewall rules, for a total of 200. You turn on shadowed rule detection for the project.

The charge for the initial evaluation is $1 per rule, so you pay a one-time charge of $1 * 200 rules, or $200.

The next day, you add a new firewall rule to one of your networks. Because you have changed your firewall rule configuration, Firewall Insights evaluates that network's configuration again. This time, you are charged $0.10 for each rule in the network. The charge would be $0.10 * 101 rules, or $10.10.

For the next month, you don't make any changes to your firewall rules, so you aren't changed anything during that time.

After that, on a single day, you modify two firewall rules in the same network where you previously added a rule. Because you made these changes on the same day, they trigger only one new evaluation. Because that network still has only 101 rules, the charge is again $10.10.

Analysis of overly permissive rules (overgranting analysis)

Billing for analysis of overly permissive rules is based on the number of firewall log entries that are processed for insight generation.

Overly permissive rules include the following:

• Allow rules with no hits
• Allow rules with unused attributes
• Allow rules with overly permissive IP address and port ranges

You are billed monthly for each million log entries that are processed.

To use log-based rule analysis, you must also have Firewall Rules Logging enabled. For details about Firewall Rules Logging charges, see the Network Telemetry pricing documentation.

Example 1

Suppose that during one month you have 997 million log entries. Because you have between 1 and 10,000 million entries, you would be charged $0.20 per million log entries, as described in the following table.

Example 2

Suppose that during one month you have 141,719 million log entries. In this case, you would be charged at all three rates, as described in the following table.

Other logs-based analysis

In addition to overly permissive rule insights, the following features use logs-based analysis:

• All Firewall Insights metrics
• The deny rules with hits insight

To use these features, you must have Firewall Rules Logging enabled. For details about Firewall Rules Logging charges, see the Network Telemetry pricing documentation.

The following table describes Firewall Insights pricing for these features.