On-Demand subscriptions allow fast and convenient access to queries and alerts against the threats your particular enterprise needs. In this read, we will clarify some of the most asked questions regarding the new types of subscriptions available on the platform and how they work exactly.
Who has access to rules unlocked via On Demand subscriptions?
Should you purchase an On Demand subscription, the unlocked rules are available not only for your account but also to all other accounts from your organization while your subscription is active. This applies to regular On Demand subscriptions, promotions, and charity-based types like “#sigma2savelives”.
Who can unlock rules via an On Demand subscription?
The unlock capability is accessible to all members of your organization registered on the SOC Prime platform. This means that once the on-demand plan is purchased, all team members would be able to access the rules they need within the limit of the purchased subscription.
Which rules would become available via #sigma2savelives On Demand Subscription?
Purchasing #sigma2savelives charity-based subscription grants instant access to the growing collection of 500+ rules to detect russian state APTs and on-demand access to 50 rules of your own choice.
You can review the list of 500+ rules, which would be accessible after purchase via this link.
What if I purchase the #sigma2savelives subscription and another On Demand plan?
You can purchase both a #sigma2savelives subscription and an On Demand plan of your choice. You would access a collection of 500+ rules to detect russian state APTs, 50 rules of your own choice, and an additional 50, 100, or 200 rules (depending on the selected On Demand plan).
Can I purchase two or more #sigma2save lives subscriptions?
Yes, technically, this is possible. You would have access to the same collection of 500+ rules to detect russian state APTs, and several 50 rules sets to access the content of your own choice. So by purchasing two plans, you would be getting access to additional 50 rules. All the money you pay goes to Come Back Alive Foundation, which helps save the lives of Ukrainians and defend Ukraine.
How do I keep track of my on-demand Sigma rule balance?
You can always check your on-demand Sigma rule balance on the counter displayed on any content item page and in Quick Hunt.
The balance is decreased by one each time you unlock a Sigma rule that is currently not available to you (the rule has just been released or your access has already expired). The first time you unlock a Sigma rule, a confirmation modal is displayed notifying that you are going to use your on-demand Sigma rule balance. Later, the selected Sigma rules are unlocked automatically.
There are two ways to instantly unlock a Sigma rule:
Open the Code tab on the rule page
Click the Hunt button for the query based on the Sigma rule in Quick Hunt
Either of these actions instantly gives you full access to the Sigma rule and all its translations. You get access for 1 year with full support and updates.
During this 1-year period, you can download and deploy the unlocked Sigma rule and all its translations, as well as use them for hunting without any limitations.