Agentic NDR charges based on the resources you use — no upfront commitment required. This page covers each billable item, its price, and how fees are calculated so you can estimate your monthly spend before purchasing.
To purchase Agentic NDR or its value-added services, visit the Cloud Firewall purchase page. For supported regions, see Supported regions.
Billing details
Agentic NDR has four billable items. The first three appear on your Agentic NDR bill. The fourth — VPC traffic mirroring — is billed separately by VPC when you connect private network assets.
| Billable item | Price | Details |
|---|---|---|
| Agentic NDR instance fee | USD 0.72 per instance/hour | One instance is created per region where you connect assets. If you enable multi-account management, instances under different accounts are billed separately. |
| Traffic processing fee | USD 0.06/GB | Charged for the total volume of inbound and outbound traffic that Agentic NDR processes, including both public and private network traffic. |
| Full traffic storage service | USD 0.46 per TB/hour | Stores complete, raw network traffic. Fees are calculated hourly, with a minimum purchase of 1 TB and in increments of 1 TB. |
| Log analysis service | USD 0.30 per TB/hour | Fees are calculated hourly, with a minimum purchase of 1 TB and in increments of 1 TB. These fees appear on your Cloud Firewall bill. |
For the full traffic storage service: for 50 Mbps of public bandwidth and a 14-day full traffic retention period, purchase 4 TB of storage. Configure custom packet filtering rules to reduce storage consumption.
For the log analysis service: for 200 Mbps of bandwidth, purchase 2 TB of storage per month. Configure custom log filtering rules to reduce storage consumption.
The pricing above covers pay-as-you-go version 2.0. If your Cloud Firewall uses the legacy billing method (version 1.0), log analysis billing works differently. To check which version applies to your account, see Pay-as-you-go (version 2.0). If you are on version 1.0, see Billing method 1.0 for the upgrade guide. For differences in log analysis behavior, see Log analysis overview.
Additional charges for private network traffic
Connecting private network assets to Agentic NDR triggers VPC traffic mirroring, which generates two additional charges billed by VPC — these appear on your VPC bill, not your Agentic NDR bill.
Traffic processed through VPC mirroring also counts toward the Agentic NDR traffic processing fee (USD 0.06/GB) listed above.
Formula:
Traffic mirror fee = Instance fee + Data processing fee
Instance fee = Number of traffic mirror sources with active sessions × Active duration (hours) × Unit price
Data processing fee = Total mirrored data (GB) × Unit price
| Billable item | Unit price |
|---|---|
| Instance fee | USD 0.014 per source/hour |
| Data processing fee | USD 0.007/GB |
Each successfully connected elastic network interface (ENI) counts as one traffic mirror source and is billed as a separate instance. Usage of less than one hour is billed as a full hour.
The traffic processing fee is waived until March 31, 2026.
How instance counts work
The number of Agentic NDR instances determines your instance fee. One instance is created per region where you connect assets.
| Scenario | Instance count | Effect on billing |
|---|---|---|
| One account, one region | 1 | 1 × USD 0.72/hour |
| One account, three regions | 3 | 3 × USD 0.72/hour |
| Multi-account management — each account in one region | 1 per account | Each account billed separately at 1 × USD 0.72/hour |
| Multi-account management — each account in three regions | 3 per account | Each account billed separately at 3 × USD 0.72/hour |
Estimate your monthly bill
Use the following formula to estimate your monthly cost before purchasing storage or enabling additional features.
Monthly estimate:
Monthly cost =
Instance fee: (Number of regions × hours in month × USD 0.72)
+ Traffic processing fee: (Total GB processed × USD 0.06)
+ Full traffic storage: (Storage TB × hours in month × USD 0.46)
+ Log analysis service: (Storage TB × hours in month × USD 0.30)
+ VPC mirroring (if private assets connected):
Instance fee: (Active ENI count × active hours × USD 0.014)
Data processing fee: (Total mirrored GB × USD 0.007)Example — single region, 50 Mbps public bandwidth, 14-day retention, no private assets:
| Fee component | Calculation | Monthly cost |
|---|---|---|
| Instance fee (1 region, 720 hours/month) | 1 × 720 × USD 0.72 | USD 518.40 |
| Traffic processing fee | Depends on actual traffic volume | Variable |
| Full traffic storage (4 TB recommended) | 4 × 720 × USD 0.46 | USD 1,324.80 |
To gauge actual traffic volume before committing to storage, enable Agentic NDR and observe usage for a period before purchasing additional capacity.