Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: What Functionality Remains After the License Expires?

EDR: What Functionality Remains After the License Expires?


EDR Servers: All versions (on premise only)


What functionality remains after the EDR license expires?


After the license expires for on-prem EDR servers:

The following features remain working:
  • The console is still accessible
  • Events are still searchable
  • Sensors still communicate (check-in) with the EDR server.
The following features no longer work after the 30-day grace period:
  • Sensors do not submit the data. They queue the data based on group configurations.
  • Threat intel no longer updates.
  • All other functions like live response, banning (new hashes) will no longer work.
  • Updates and new software packages are not available.

Additional Notes

  • Hosted EDR instances shut down after a 30 day grace period.

Related Content

Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Creation Date: