License
Which features need a licence, self-serve trial, online and offline activation, what the fingerprint is made of, how the sealed detection engine unlocks, what each status means.
The generic flow (online / offline, deactivation, common errors) is under Platform → Licensing; this page covers what is specific to Splunk AI Copilot. "License" is a tab of Settings, admin-only.
What needs a licence
| Tier | Includes |
|---|---|
| Not activated | Smart query, search commands, explain, field dictionary, knowledge base, posture / alerts / reports (no executive summary) / audit / assets / baseline / channels |
| Trial | 14 days, one host, all features; whether the detection key ships with a trial is decided by the licence server's tier settings |
| Enterprise | features ["*"]: triage, investigation, detection rules, platform-health interpretation, onboarding generation, report executive summaries; unlimited nodes |
Self-serve trial (1.9.0+)
Enter email and company, accept the terms, click "Request 14-day trial". The app sends app_id, host fingerprint and server GUID to the licence server and activates as soon as the licence is issued; when the server requires review it shows "submitted, the licence will be emailed after approval". One request per host (the server checks the fingerprint); a second click returns trial_already_requested.
Online activation
Paste the licence token, "Activate". The app verifies the signature locally, binds this host on the licence server and heartbeats from then on; renewals, upgrades and keys for new paid features arrive with the heartbeat. "Reload" pulls immediately. When the server is unreachable the offline grace applies (offline_grace_days, default 14), after which the licence lapses.
Offline activation
Air-gapped: copy the host fingerprint (64 hex characters) to Reallysec, then paste or upload the .lic on the "Offline" tab. Signature and fingerprint are checked locally and the licence unlocks; no heartbeat, no egress afterwards. An offline licence's feature set is fixed in the file; the detection engine needs the key included at issue time (--with-keyring), otherwise that feature reports feature_sealed.
Fingerprint = Splunk's server GUID (etc/instance.cfg) + the host's /etc/machine-id (Linux) / product_uuid / registry MachineGuid (Windows). A container without /etc/machine-id fails activation outright (machine_id_unreadable); inject a fixed value in the image or at start. Rebuilding the instance, changing the GUID or losing machine-id counts as a new machine and needs re-activation.
The sealed detection engine
The prompts and logic behind detection-rule drafting are not in the package as plaintext: bin/detection_core.sealed is ciphertext, and its per-feature data key comes back from the licence server inside feature_keyring on activation / heartbeat, bound to this host's fingerprint and unwrapped in memory. Without the key the feature reports feature_sealed; nothing else is affected. Having the package is not having the feature, and a revoked licence locks it at the next heartbeat.
Status meanings
| Status | Meaning | Action |
|---|---|---|
| Not activated | No licence | Request a trial or paste a token |
| Valid | Normal; shows expiry, licence id, type, last heartbeat | — |
| In grace period | No successful heartbeat for over 24 hours, still within offline grace | Check outbound to license.reallysec.com:443 |
| Expired / Revoked / Invalid | Paid capabilities locked | Contact sales; invalid usually means the token belongs to another machine (license_host_mismatch) |
Replace, renew, deactivate
Paste a new token and activate; no need to deactivate first. "Deactivate" returns to not-activated and releases the online seat, do it before moving hosts; it also clears the local feature keys, and an app upgrade does not require it.
AI settings
Engine status, provider cards and the failover chain, thinking mode, semantic retrieval (embeddings), the 24-hour call trend.
MCP
Expose the read-only tools and investigate / triage / explain / generate to external agents (Claude Desktop, Cursor, your own): Streamable HTTP, tokens issued per role, the same gates and audit as the UI. Since 1.9.0.