Pricing

Query Subscriptions: The Foundation of ET Ducky

Every plan includes the full diagnostic engine: kernel-event capture on every endpoint, root cause analysis on every alert, behavioral detections, remote desktop, scripts, alerts, and fleet management. Plans differ only in how many AI diagnostic queries you run per month.

What Are Queries Used For?

Desktop Monitoring

Ask questions during local ETW monitoring sessions on your machine

Live Query Sessions

Interactive troubleshooting on single remote agents (1 query per session)

Multi-Agent Queries

Query multiple devices simultaneously (1 query per device)

Cross-Correlation

Analyze events across multiple agents with correlation (1 query per device)

Alert Analysis

Automated root cause analysis for triggered alerts (1 query per alert)

Free

$0 /month

Bring Your Own API Key

Full ETW monitoring capabilities
Local event correlation
Use your own API key (Anthropic, OpenAI, Copilot supported)
Desktop app and agent support
Unlimited live sessions
Organization support
No query limits with your own key

Professional

$39 /month

1,000 Queries Per Month

Everything in Free
Cloud-based event processing
No API key needed
Desktop + agent + alert support
Multi-agent query sessions
Cross-correlation analysis
Priority support
Usage analytics dashboard
20 free agents per subscribed member
Queries & agents pool across your org

Business

$99 /month

5,000 Queries Per Month

Everything in Professional
5x query capacity
Team collaboration tools
Advanced event correlation
Historical analytics
Automated alert analysis
Dedicated support channel
20 free agents per subscribed member
Queries & agents pool across your org

Enterprise

$249 /month

50,000 Queries Per Month

Everything in Business
50x query capacity
Enterprise-scale monitoring
Custom integrations
Advanced multi-agent correlation
SLA guarantee
White-glove support
20 free agents per subscribed member
Queries & agents pool across your org
Organization-wide analytics

Organization Quota Pooling

When multiple users join an organization, their individual query quotas and free agent seats automatically combine into shared pools that any member can use across all use cases.

How It Works

Each subscribed member contributes their query quota and 20 free managed agent seats to the organization
Any member can use queries and agents from the shared pools
Queries work across Desktop app, agents, multi-agent sessions, and alerts
Example: 3 Professional users = 3,000 queries/month + 30 free managed agents for the entire organization
Real-time quota tracking shows organization-wide usage for both queries and agent seats

Query Usage Examples

Understanding how queries are consumed helps you choose the right subscription tier:

Use Case	Query Cost	Example
Desktop Monitoring	1 query per question	"Why is this application crashing?" = 1 query
Single Agent Query	1 query per session	Live troubleshooting on one server = 1 query
Multi-Agent Session	1 query per device	Query 5 web servers simultaneously = 5 queries
Cross-Correlation	1 query per device	Correlate events across 3 database servers = 3 queries
Alert Root Cause	1 query per alert	Automated analysis of disk space alert = 1 query

Desktop Application

The ET Ducky Desktop application is a free download that runs on Windows 10/11. It captures and correlates ETW events locally, then uses your query subscription to process diagnostic requests.

Key Features

Local ETW event capture and correlation
Real-time system monitoring
Interactive troubleshooting sessions
Shares query quota with agents and alerts
No agent deployment required
Works with Free tier (BYOK) or paid subscriptions

Perfect for developers, IT professionals, and power users who want to diagnose issues on their own machines without deploying infrastructure.

Frequently Asked Questions

What counts as a query?

Each request to process correlated ETW events through the ET Ducky API server counts as one query. This includes diagnostic requests from the Desktop app, live session queries from agents, multi-agent queries (1 per device), cross-correlation analysis (1 per device), and automated alert analysis.

Can I use queries with both the Desktop app and agents?

Yes. Your query subscription provides a shared pool that works with the Desktop application, all deployed agents, multi-agent queries, cross-correlation sessions, and automated alert analysis. All queries count against the same monthly quota regardless of source.

What happens if I exceed my quota?

Once your monthly quota is reached, cloud-based processing will be paused until the next billing cycle. You can upgrade at any time, or switch to BYOK mode with the Free tier.

Do queries reset monthly?

Yes. Your query quota resets at the start of each billing cycle. Unused queries do not roll over.

What about data retention?

All plans include 14-day data retention at no cost. You can extend retention to 90 days, 1 year, or 2 years with the Data Retention add-on, billed per managed agent per month. See the Data Retention tab for pricing details.

How does organization quota pooling work?

When multiple users join an organization, their individual query quotas and free agent seats combine into shared pools. For example, if 3 users each have Professional plans (1,000 queries each), the organization gets a pool of 3,000 queries and 30 free managed agents that any member can use for desktop monitoring, agent queries, multi-agent sessions, cross-correlation, or alert analysis.

Ready to Get Started?

Choose your query subscription to deploy your first twenty agents for free!

Agent Pricing

Purchase agent seats (required for managed agents). Volume pricing is applied automatically.

ET Ducky uses a simple per-agent model for managed agents (Windows Service). Desktop agents (the Windows app) are free and unlimited.

Managed Agents (Service)

Shared / Entry: 20 agents free per subscribed user, then $5/agent/month
Dedicated Tier 1 (100–999): $4/agent/month
Dedicated Tier 2 (1,000–9,999): $3/agent/month
Dedicated Tier 3 (10,000+): $2/agent/month

Desktop Agents (App)

Price: Free (unlimited)
Use case: Deep-dive troubleshooting and interactive sessions when you need it

Annual billing: Save 15% on your agent and platform costs when billed annually.

What counts as a “Managed Agent”?

A managed agent is a Windows Service installed on servers or workstations that performs health monitoring, optional ETW collection, alert evaluation, and remote configuration.

Data retention add-on: Extend data retention beyond the default 14 days with per-agent pricing starting at $0.50/agent/month. See the Data Retention tab for full pricing.

Tip: Use the Calculator tab to estimate your monthly or annual total (platform + agents + hosting + retention).

Cloud Hosted Deployment

Fully-managed infrastructure by ET Ducky. Deploy agents, we handle everything else. Requires a query subscription to power diagnostics and analysis.

Zero infrastructure management
Automatic updates and scaling
Built-in high availability
AI processing included in query subscription
Get started in under 1 hour

Note: Cloud hosted agents require both a query subscription (for diagnostics) and agent seats (for infrastructure). Query subscriptions are covered in the Query Subscriptions tab.

Agent Seat Pricing

20 agents per subscribed user are FREE! Pay only for agents beyond your free allowance. Org members without their own subscription do not add free agents.

11-99 agents

$5/agent/mo

$4.25 annual

100-999

$4/agent/mo

$3.40 annual

1,000-9,999

$3/agent/mo

$2.55 annual

10,000+

$2/agent/mo

$1.70 annual

Save 15% with annual billing

Infrastructure Tiers

Optional dedicated infrastructure for enhanced performance and isolation.

Tier	Agent Range	Infrastructure Fee	What You Get
Shared	0-99 agents	$0/month	Shared multi-tenant infrastructure Standard support etducky.com access
Dedicated Tier 1	100-999	+$87/month	Your subdomain (yourcompany.etducky.com) Dedicated instance + database Priority support (24h) Optional upgrade at 100 agents
Dedicated Tier 2	1,000-9,999	+$194/month	Everything in Tier 1 plus: Load balanced (2 instances) Redis caching 90-day retention Recommended at 1,000 agents
Dedicated Tier 3	10,000+	+$666/month	Everything in Tier 2 plus: High availability (99.9% SLA) HA database (2-node) 24/7 support (4h response) Dedicated CSM Required at 10,000 agents

Infrastructure fees are flat rates per tier and don't increase with agent count. At 5,000 agents, infrastructure is only 1.3% of your total bill.

Example Monthly Costs

Note: Add your query subscription cost separately

50 agents

40 billable × $5 = $200
Infrastructure: $0 (shared)

$200/month

$170/mo with annual

+ query subscription

POPULAR

120 agents

110 billable × $4 = $440
Infrastructure: +$87 (Tier 1)

$527/month

Tier 1 optional

+ query subscription

5,000 agents

4,990 × $3 = $14,970
Infrastructure: +$194 (Tier 2)

$15,164/month

Infrastructure = 1.28%

+ query subscription

25,000 agents

24,990 × $2 = $49,980
Infrastructure: +$666 (Tier 3)

$50,646/month

Infrastructure = 1.31%

+ query subscription

Ready to Get Started?

Start with a query subscription, then deploy 20 free agents per subscribed user

Choose Query Subscription

Self-Hosted Deployment

Run ET Ducky on your own infrastructure with complete control and data sovereignty. Queries use your own API keys - no query subscription needed.

Your Infrastructure: Run on your own servers or cloud
Your Database: Complete data control
Your AI Keys: Use your own Anthropic/OpenAI API keys
No Query Limits: Pay your AI provider directly, no ET Ducky query costs
80-90% Cost Savings: At scale vs cloud hosting
Air-Gap Support: Works in isolated networks
Compliance Ready: HIPAA, FedRAMP, SOC2

Annual Subscription License

Best for: 1-3 year deployments, operating expense (OpEx) budgets, evaluation periods

Agent Tier	Annual License	Setup Fee	Year 1 Total
Up to 1,000 agents	$10,000/year	$2,500	$12,500
Up to 5,000 agents	$25,000/year	$2,500	$27,500
Up to 10,000 agents	$40,000/year	$2,500	$42,500
Up to 25,000 agents	$50,000/year	$2,500	$52,500

What's Included

Software:

Custom Docker image
Custom agent installer
Signed license key
Quarterly updates

Documentation:

Deployment guides
Docker templates
Database scripts
Best practices

Support:

Business hours
Email/ticket support
24-hour response
Annual renewal

Agent Tier	Perpetual License	Annual Maintenance	Break-even
Up to 1,000 agents	$35,000	$3,500 (10%)	3.5 years
Up to 5,000 agents	$85,000	$8,500 (10%)	3.4 years
Up to 10,000 agents	$140,000	$14,000 (10%)	3.5 years
Up to 25,000 agents	$175,000	$17,500 (10%)	3.5 years
Up to 50,000 agents	$250,000	$25,000 (10%)	3.3 years
Up to 100,000 agents	$350,000	$35,000 (10%)	3.5 years

Your Infrastructure Costs (Estimated)

In addition to the license fee, you'll need to budget for your own infrastructure and AI API usage.

Component	1,000 Agents	5,000 Agents	10,000 Agents
Docker Host	~$50-100/month	~$150-300/month	~$300-500/month
PostgreSQL Database	~$50-100/month	~$100-200/month	~$200-400/month
AI API Usage	~$200-500/month	~$500-1,500/month	~$1,000-3,000/month
Total (Your Costs)	~$300-700/month	~$750-2,000/month	~$1,500-3,900/month

Actual costs vary based on cloud provider, region, and AI usage patterns. Self-hosted deployments use your own API keys, so you pay your AI provider directly based on your actual query usage.

Ready to Deploy Self-Hosted?

Contact our sales team to get started with self-hosted deployment

Contact Sales

Or email [email protected]

Data Retention Add-On

By default, ET Ducky retains diagnostic data for 14 days at no additional cost. Extend retention to keep historical events, health metrics, correlations, and session data longer for trend analysis, compliance, and root-cause investigations.

Per-agent pricing — retention is billed per managed agent per month. The quantity auto-syncs as you add or remove agents.

Default

14 days

Free

Included with all plans

✓ Events & event batches

✓ Health metrics & records

✓ Correlations & patterns

✓ Session data

Extended

90 days

$0.50 /agent/mo

Quarterly trend analysis

✓ Everything in default

✓ 90-day event history

✓ Quarterly health trends

✓ Extended correlation data

RECOMMENDED

Annual

1 year

$1.50 /agent/mo

Year-over-year comparison

✓ Everything in 90 days

✓ Full annual event history

✓ Year-over-year health trends

✓ Long-term pattern detection

Maximum

2 years

$2.50 /agent/mo

Compliance & deep history

✓ Everything in 1 year

✓ 2-year complete archive

✓ Multi-year trend baselines

✓ Compliance-ready retention

How Data Retention Works

Per-Agent Billing

Retention is billed per managed agent per month via Stripe. When you add or remove agents, the quantity on your retention subscription auto-syncs within seconds.

Automatic Purging

A background service runs daily at 3 AM UTC and removes data older than your retention window. Purges run in small batches to minimize database impact.

What's Retained

Events, event batches, health metrics, health records, event summaries, correlation analyses, detected patterns, ETW correlations, live sessions, and shell command history.

Upgrade Anytime

Switch retention tiers from your Dashboard. Upgrades take effect immediately. Downgrades take effect at the next billing cycle — data beyond the new window is purged at the next daily run.

Example Retention Costs

Monthly cost for retention add-on only (agent seats and platform plan billed separately)

Agents	90 Days ($0.50)	1 Year ($1.50)	2 Years ($2.50)
10 agents	$5/mo	$15/mo	$25/mo
50 agents	$25/mo	$75/mo	$125/mo
200 agents	$100/mo	$300/mo	$500/mo
1,000 agents	$500/mo	$1,500/mo	$2,500/mo

Retention FAQ

What happens if I cancel my retention subscription?

Your retention reverts to the default 14-day window. At the next daily purge (3 AM UTC), data older than 14 days will be removed.

Does retention apply to desktop app data too?

Retention applies to all data stored in the cloud — events from managed agents, desktop app sessions that sync to the cloud, health metrics, correlations, and patterns.

Can I set different retention periods for different data types?

Organization admins can set custom overrides per data category (events, metrics, correlations, session data) that are shorter than or equal to the purchased tier. Contact support for custom configurations.

Is retention included with self-hosted deployments?

Self-hosted deployments control their own data retention through database configuration. The retention add-on and automatic purging are cloud-hosted features only.

Need Longer Retention?

Add data retention from your Dashboard under Subscription settings.

Use the Calculator tab to estimate your total cost including retention.

Pricing Calculator

Estimate your monthly or annual cost based on platform plan, agent count, hosting tier, and data retention.

Platform plan

Includes shared query quota for desktop app and agents.

Managed agents

Desktop agents remain free and unlimited (not included here).

Subscribed users

20 free agents per user with a query subscription — 20 free agents included. Adding org members without their own subscription does not add free agents.

Billing

Monthly Annual (15% savings)

Annual billing applies a 15% discount to the recurring total.

Data retention

Billed per managed agent. Auto-syncs when agents are added or removed.

Estimated total

per month

Opens the same seat purchase dialog as your Dashboard.

Breakdown

Platform plan$0

Free agents included10

Managed agents$0

Data retention$0

Total$0

Feature Comparison

Every plan includes the full diagnostic feature set. Differences are in query volume and concurrency, not capability. Managed agents are sold separately on every paid plan; desktop agents are free and unlimited everywhere.

Feature	Free (BYOK)	Professional $39/mo	Business $99/mo	Enterprise $249/mo
AI Queries
Monthly query quota	Unlimited via your API key	1,000	5,000	50,000
API key	Customer-supplied Anthropic / OpenAI / Copilot	Included	Included	Included
Multi-agent correlation	✓	✓	✓	✓
Quota pool across team members	— per-user keys	✓	✓	✓
Agents
Desktop agents (free)	Unlimited	Unlimited	Unlimited	Unlimited
Free managed agent seats per subscriber	—	20	20	20
Additional managed agents	—	$5/agent/mo vol. discounts to $2	$5/agent/mo vol. discounts to $2	$5/agent/mo vol. discounts to $2
Diagnostics & Live Sessions
Live Query Sessions (AI)	✓	✓	✓	✓
Approved script execution (PowerShell / CMD)	✓	✓	✓	✓
Bidirectional file transfer	✓	✓	✓	✓
Browser-based remote desktop	✓	✓	✓	✓
Multi-agent broadcast (shell + push)	✓	✓	✓	✓
30+ ETW providers, configurable	✓	✓	✓	✓
Monitoring & Security
Real-time health metrics	✓	✓	✓	✓
Anomaly-triggered ETW flush	✓	✓	✓	✓
Security posture (AV, firewall, BitLocker, UAC, Secure Boot)	✓	✓	✓	✓
Behavioral ransomware detection + auto-isolation	✓	✓	✓	✓
Risk-scored command execution	✓	✓	✓	✓
Alerts & Automation
Rule-based alerts with AI root-cause analysis	✓	✓	✓	✓
Notification channels (Email / Slack / Teams / Webhook)	✓	✓	✓	✓
Ticket-triggered automated troubleshooting	✓	✓	✓	✓
Approved scripts repository	✓	✓	✓	✓
Reports & Analytics
Smart Reports (natural-language report builder)	✓	✓	✓	✓
Historical AI Analysis	✓	✓	✓	✓
Data Explorer (visual query builder)	✓	✓	✓	✓
KB Documentation (auto-recorded from ETW)	✓	✓	✓	✓
Team & Multi-Tenancy
Auto-provisioned subdomain (`etd-XXXXXX.etducky.com`)	✓	✓	✓	✓
Custom subdomain rename	✓	✓	✓	✓
Multiple Clerk orgs per subdomain (MSP mode)	✓	✓	✓	✓
Custom domain mapping (CNAME)	✓	✓	✓	✓
SAML 2.0 SSO & SCIM provisioning	via Clerk	via Clerk	via Clerk	via Clerk
Audit log of every command / lift / config change	✓	✓	✓	✓
Integrations
Jira / ServiceNow ticketing	✓	✓	✓	✓
Native ET Ducky tickets	✓	✓	✓	✓
Script repos (GitHub / Azure Blob / HTTP)	✓	✓	✓	✓
Data Retention
Default retention	14 days	14 days	14 days	14 days
Extended retention available (90d / 1y / 2y)	—	$0.50 – $2.50 per agent / mo	$0.50 – $2.50 per agent / mo	$0.50 – $2.50 per agent / mo
Support
Email support	✓	✓	Priority	Dedicated channel
Annual billing discount (15%)	—	✓	✓	✓

The differentiator across plans is query capacity and support tier, not feature access. If your team's diagnostic load fits BYOK, every paid feature is still available — you just bring your own API key. Upgrade only when the cloud-managed query pool makes sense for your workflow.

Pricing

Query Subscriptions: The Foundation of ET Ducky

What Are Queries Used For?

Desktop Monitoring

Live Query Sessions

Multi-Agent Queries

Cross-Correlation

Alert Analysis

Free

Professional

Business

Enterprise

Organization Quota Pooling

How It Works

Query Usage Examples

Desktop Application

Key Features

Frequently Asked Questions

What counts as a query?

Can I use queries with both the Desktop app and agents?

What happens if I exceed my quota?

Do queries reset monthly?

What about data retention?

How does organization quota pooling work?

Ready to Get Started?

Agent Pricing

Managed Agents (Service)

Desktop Agents (App)

What counts as a “Managed Agent”?

Cloud Hosted Deployment

Agent Seat Pricing

Infrastructure Tiers

Example Monthly Costs

Ready to Get Started?

Self-Hosted Deployment

Annual Subscription License

What's Included

Perpetual License

Why Choose Perpetual?

10-Year Cost Comparison (5,000 Agents)

Your Infrastructure Costs (Estimated)

Ready to Deploy Self-Hosted?

Data Retention Add-On

How Data Retention Works

Per-Agent Billing

Automatic Purging

What's Retained

Upgrade Anytime

Example Retention Costs

Retention FAQ

What happens if I cancel my retention subscription?

Does retention apply to desktop app data too?

Can I set different retention periods for different data types?

Is retention included with self-hosted deployments?

Need Longer Retention?

Pricing Calculator

Feature Comparison