Licensing and suites
Lawliet licences are verified on your own server. There is no licence server, no check-in and no internet needed, at activation or afterwards.
Suites
| Suite | For | Includes |
|---|---|---|
| Comply | Proving the estate is compliant and fixing what is not | Continuous compliance and drift, hardening with approval and rollback, scheduled reports, network discovery and topology, firewall rule-set review |
| Operate | Watching the estate every day and acting on it | Log collection, search and detection, file integrity monitoring, data loss prevention, alerts in one review queue |
| Complete | Watching, proving and investigating on the host | Everything in Comply and Operate, plus digital forensics and active defence |
Every suite includes the review queue, evidence bundles, SIEM forwarding, role-based access, four-eyes approval, two-factor sign-in, the audit trail, all updates and email support. Each suite is sized on its own for up to 30, 100, 500, 1,000 or 3,000 agents, or every host with a site licence.
Other ways to buy
- 30-day evaluation on your own hardware, 5 agents, demo data, free.
- 60-day pilot, up to 50 agents, on Complete; the fee is credited if you subscribe.
- 90-day run-it-yourself licence for one project, any suite; credited in full if you subscribe within 60 days.
- Perpetual licence for air-gapped and public-sector sites, with maintenance.
Build your own
If a suite does not fit, build a licence from individual modules. A build is sized with the same tiers as the suites and includes the same base, and the licence carries exactly the modules you choose.
| Module | What it covers | Rule |
|---|---|---|
| Compliance and hardening | Scans against CIS, NIST, ISO 27001, PCI DSS and more; drift; hardening with approval and rollback; scheduled reports and evidence | Sold on its own |
| Firewall governance | Rule-set review and optimisation for 14 firewall vendors; export for import; live apply with four-eyes approval; monitoring of connected firewalls | Sold on its own; the number of firewalls grows with the size tier |
| Network discovery and topology | Discovery across your segments, device inventory, topology | Only together with Firewall governance |
| Log collection and detection | Collection, search, Sigma and correlation rules, alerts, entity risk, dashboards | Sold on its own |
| Data loss prevention | Custom policies, data discovery and where-is-this-file, blocking of USB, uploads, print and email on Linux | Sold on its own |
| File integrity monitoring | Custom policies, on-host baseline and verify, the process behind each change | Sold on its own |
| Forensics and hunting | Live response, triage and memory capture, case timeline, fleet IOC and YARA hunts | Sold on its own |
| Active defence | Isolate, block, quarantine, kill and disable on the host, each with undo and four-eyes approval | Needs at least one of Forensics and hunting, Log collection and detection, Data loss prevention or File integrity monitoring |
Every build includes the same base as the suites: review queue, evidence bundles, SIEM forwarding, role-based access, four-eyes approval, two-factor sign-in, the audit trail, all updates and email support. Builds use the same sizes as the suites (up to 30, 100, 500, 1,000 or 3,000 agents, or a site licence) and have a minimum size.
A suite always costs less than buying its modules one by one, so a suite is the better value when it fits. Build your own when you need less, or a different mix.
Activation
Bundles ship without a licence. The licence is issued to the installation you create:
- The installer prints the installation fingerprint: 32 characters that identify this installation and nothing else.
- You send it to us by any channel.
- We return a licence key bound to that fingerprint.
- You paste it into the console's activation screen, or run
./lawliet licence <key-file>.
A bound key refuses to activate on any other installation, so a copied bundle or key is useless elsewhere.
Renewal
A renewed key is entered the same way, under Settings, Licence, or with ./lawliet licence. It takes effect immediately and stays in place across restarts and updates. A key older than the one in use is refused.
When a licence expires
The platform pauses: the console and API refuse requests until a valid licence is installed. Sign-in, two-factor, the licence page and pending approvals stay available so a renewal can be entered. Your data is untouched.
One-time engagements
A single job, such as a compliance assessment with hardening, a network map or a firewall review, runs on an engagement licence. It carries only the modules that job needs and a host limit, for a fixed work window.
- Work window. The job's modules work normally. The console shows the engagement's reference and the days left.
- Close-out. The platform turns read-only. You can still export evidence bundles and generate reports.
- Decommission. Under Settings, Licence, Decommission all agents tells every agent to remove itself from its host. Under dual control it needs a second approver.
- Expiry. At the end of close-out the licence expires.
./lawliet uninstallremoves the server.
A host that will not check in again can be cleaned by hand: sudo bash install_linux.sh --uninstall, sudo bash install_macos.sh --uninstall, or install_windows.ps1 -Uninstall.
Reinstalling or moving servers
The fingerprint belongs to the installation's configuration volume. A restore of a backup onto the same installation keeps it. A fresh installation on a new server has a new fingerprint and needs a new key; ask us before you move.