Activation
Which capabilities need a licence, how to get a trial, online and offline activation, licence states, upgrade notes.
The generic flow (online / offline, deactivation, common errors) is under Platform → Licence activation; this page covers what is specific to Elastic AI Copilot. "Activation" sits in the tabs of Settings, administrators only.
What needs a licence
| Tier | What you get |
|---|---|
| Unactivated | Smart query, all masking modes, posture / audit / reports / runbooks / baseline / ledger, under a daily LLM quota (200 by default) |
| Trial | = Standard for 14 days, one host. Apply in the console |
| Standard / Enterprise | The four paid engines: alert batch triage, alert investigation, detection-rule drafting, platform-ops copilot (the AI read on Platform health) |
The four paid engines ship encrypted: the image carries only ciphertext, and the licence server issues each key per tier, bound to the activated host. A gateway without a licence cannot run them.
Overview
| Card | Meaning |
|---|---|
| Licence state | See the table below |
| Expiry | Days left; "renew soon" within 30 days |
| Unlocked features | Listed per feature, or "wildcard * (Enterprise)" |
| Usage | Today's quota when unactivated; "unlimited" once activated; last heartbeat |
States
| State | Meaning | Do |
|---|---|---|
| Unactivated | No licence; free features under quota | Apply for a trial or buy |
| Valid | Normal | — |
| Expiring | Within 30 days of expiry | Renew, paste the new key |
| Grace period | Online licence cannot reach the licence server but is inside the offline grace | Check outbound access to license.reallysec.com:443 |
| Heartbeat lost | Grace nearly used up | Same; expires automatically after the grace period |
| Expired / revoked / invalid | Paid engines locked | Contact sales; invalid usually means the key belongs to another host |
Since 1.1.21 an invalid licence no longer blocks login, logout, password change or deactivation.
Online activation
Paste the token from the console (starts with ey…) and click Activate. The gateway binds this host with the licence server and heartbeats every 5 minutes; renewals, tier changes and keys for new engines arrive over the heartbeat. The host fingerprint never has to be sent to anyone.
Offline activation
Air-gapped: copy the host fingerprint (64 hex characters), send it to Reallysec, and upload the returned .lic file (or paste its contents). Signature and fingerprint are verified locally; no heartbeat, nothing leaves the network. An offline licence's feature set is fixed in the file; renewals and tier changes need a re-issued one.
The fingerprint is derived from state/machine-id and state/server_guid in the install directory. Never regenerate them; back up the whole state/ directory.
Replace or renew / deactivate
- Replace or renew: paste the new key and activate; no need to deactivate first.
- Deactivate: back to unactivated; an online licence returns its host seat to the server. Do this before moving to another host.
Upgrade notes
- Offline licences issued before 1.1.20 carry no keys for alert triage / investigation / platform-ops copilot; a re-issued
.licis needed for them. Online licences are unaffected. - Online licences on 1.1.5 – 1.1.19 never completed a heartbeat (a bug in those versions); the first heartbeat after upgrading to 1.1.20+ delivers the missing keys.
- Since 1.1.21
state/server_guidlives in the install directory instead of the Docker volume;deploy.shmigrates it on upgrade, so the fingerprint does not change. Upgrading by hand, rundocker cp rst-elastic-ai-copilot-gateway:/app/state/server_guid state/server_guidbeforeup -d.