A monitored host / instance is defined as a physical or virtual network element, server, or machine that sends data to Sift Security. In cases where there is an intermediate device (e.g. Network Device, Log Management tool, etc.) that sends data, you should count the entities that generate the data. In some situations monitoring the number of users is a more appropriate metric, in which case we may be able to scale on users instead of hosts. Calculation = sum the total instances for each day in the month / # of days in the month.
Organizations that want to run CloudHunter on their own AWS instance, a private SaaS license is available.