Signals
A signal is a message from a sensor that Pharos checked, and it is the whole billable unit. Connecting a manager is free. There is no per-manager fee and no licence, and the bill follows what the connected fleet actually sends. Billing runs on a volume ladder, so the per-signal rate falls as monthly volume grows, and the console's Billing page shows the price list, the tenant's position in it, and the bill so far.
What counts as a signal
| The sensor sends | One signal is |
|---|---|
| An alert from a manager's stream | one alert that carried at least one value Pharos had to look up |
| The fleet's vulnerability state | one vulnerable package on one agent, counted once per billing month |
| An event from a sibling Labs service | one event sent to be checked |
Two consequences worth naming:
- The vulnerability unit is the remediation, not the CVE. One agent, one package to upgrade, one signal a month. A package gaining more CVEs next month is not a new charge, and re-reporting an open vulnerability every hour costs nothing.
- The lookup unit is the alert, not the value. An alert typically carries several values, and it is metered once.
What is never a signal
- Reading the corpus. Searches, facets and CVE pages are what the subscription buys, and none of it is metered.
- A person pasting a value into Investigate. A person is not a sensor, and the lookup stays free even when the fleet is stopped at its limit.
- Heartbeats and inventory reports from the sidecar.
- An alert the sidecar answered from its own cache. It never reached Pharos, so it was never checked.
The monthly limit
Every tenant carries a monthly limit, expressed in signals rather than in dollars, and the console shows the resulting price next to it. New tenants start at 1,000 signals a month. The limit is self-service up to 200,000, and support raises it beyond that. Notices go out at 50, 80 and 100 percent, once each per billing month, and the counter is exact and live.
Stopping at the limit is the default. At 100 percent the fleet stops reporting, and that is a pause rather than an outage:
- Heartbeats and inventory keep flowing, so the managers stay visible on the Managers page.
- Investigate keeps answering.
- The console, the search and the Signals inbox are unaffected.
Raising the limit restores reporting immediately. On resume the sidecar starts at the present rather than replaying the backlog, so a capped week does not become a burst bill. An admin can turn stopping off, and the fleet then keeps reporting past the limit.
The counter resets on the billing month boundary.