Subscription - Cloud Firewall - Alibaba Cloud Documentation Center

This topic describes the subscription billing method for Agentic NDR.

Billing details

Important

To purchase Agentic NDR as a value-added service, go to the Cloud Firewall purchase page.
If you have already purchased the subscription version of Cloud Firewall, click Upgrade on the right side of the Cloud Firewall Overview page to purchase the full Agentic NDR service.
For regions where Agentic NDR supports asset access, see Supported regions.

Feature and billing item	Price	Description
Agentic NDR	USD 1,500/month	Includes 200 Mbps bandwidth, two Agentic NDR instances, and 30 GB of attack message storage capacity. Each Agentic NDR instance supports both public and private network access. One Agentic NDR instance corresponds to each region where assets are connected. If multi-account management is enabled, Agentic NDR instances under different accounts incur separate instance fees.
Additional instance	USD 360/instance/month	Purchase additional instances if the number included in your plan does not meet your business needs.
Additional bandwidth	USD 7/Mbps/month	Purchase additional bandwidth if the bandwidth included in your plan does not meet your business needs. The total bandwidth includes both inbound and outbound traffic (covering both public and private network traffic, with shared quotas). Purchase in increments of 10 Mbps.
Elastic traffic processing	USD 0.06/GB	Handles traffic that exceeds your purchased bandwidth. This feature is enabled by default and cannot be disabled. The maximum elastic bandwidth is 10 Gbps. Contact your account manager or solutions architect for custom requirements. For more information, see Pay-as-you-go elastic traffic for subscription plans.
Log storage capacity	USD 80/1 TB/month	Purchase in 1 TB increments. Billed through Agentic NDR. Note Purchase recommendation: For Agentic NDR with 200 Mbps bandwidth, we recommend purchasing 2 TB/month of log storage space and configuring custom log filtering rules to save storage capacity.
Full traffic storage capacity	USD 115/1 TB/month	Stores complete raw network traffic. After the attack message storage quota included in your plan is exhausted, attack messages can continue to be stored in the full traffic storage capacity. Minimum purchase is 1 TB, in 1 TB increments. Billed through Agentic NDR. Note Recommendation: For 50 Mbps public bandwidth and 14 days of full traffic retention, select 4 TB of storage. Configure custom message filtering rules to reduce storage usage.

Additional billing for private network traffic

When connecting private network assets, additional VPC traffic mirroring fees apply. These include instance fees and traffic processing fees, which are metered and billed by VPC and appear on your account bill.

Billable items

Traffic mirror fee = instance fee + data processing fee

Instance fee = Number of traffic mirror sources with active sessions (count) × Active duration of sessions (hours) × Unit price of instance fee (USD/count/hour)
Data processing fee = Total mirrored data (GB) × Unit price (USD/GB)

Billable item	Unit price
Instance fee	0.014 (USD/count/hour)
Data processing fee	0.007 (USD/GB)

Note

Each successfully connected elastic network interface (ENI) is counted and billed as a separate instance.
Traffic processing fees are waived until March 31, 2026.
For private network Agentic NDR traffic redirection, instance fees for each connected ENI are billed hourly. Usage under one hour is rounded up to one hour.