No response from Sales for Student License (Self-Managed )

Elastic Security SIEM
1

Hi everyone,

I am a final-year student, working on my graduation project (Threat Detection with Elastic Security on local VMs).

I need to test Email Connectors for detection rules (Platinum feature). I contacted Support, and they told me to fill out the Contact Sales form. I did that 4 days ago, but I haven't received any response, and my project defense is approaching fast.

Since I am an individual student with no budget, corporate sales channels aren't working for me.

Can a Community Manager or Elastic Team member help me get a temporary 60-day trial JSON license for my local VMs so I can finish my project?

Thank you, Borhen Alaya

2

I'm not from Elastic, but wouldn't the 30 days Trial be enough?

You can spin-up a local cluster, start the trial and you will have 30 days of Enterprise features.

If this is not enough, you could just snapshot your data and restore it in a new cluster with a new trial of 30 days.

3

Hi leandrojmp,

Thank you for the reply and for the great tip about snapshotting the data!

The main reason 30 days is a bit tight for me is the university timeline. My project is split into multiple stages:

  1. June: I need to finish the technical implementation, thoroughly test the rules, and master the alerting workflow.

  2. June/July: I have to document everything in detail for my final project report and review the live setup with my academic supervisor.

  3. July/August: The official defense in front of the university jury takes place, where I must do a live demonstration.

Managing data snapshots and rebuilding the cluster right before the jury presentation adds a lot of stress if something goes wrong. Having a stable 60-day window would let me focus entirely on my research and report writing without worrying about the license expiring midway through my supervisor reviews.

I'm hoping an Elastic team member might see this and be able to help with a temporary academic extension to cover this period. Thanks again for your help!

Best regards, Borhen

4

Yeah, I understand, but the timeline you described may require more than 60 days, what if you start a 60 days license on June 1st, then your defense is postponed to the middle of August?

Being honest, based on similar posts I would not have my hopes up on getting a 60 days license and would focus on making the implementation something that can be recrated quickly.

For the cluster use docker, there is the official documentation on how to start it using docker.

For your custom data you may snapshot it and restore in each new cluster, or just index it again every time, it may be easier to just index it every time if you start the process thinking in this way.

For the security rules you can export and impor them without any issue.

If you have any doubts about those steps you may open a different topic so people on the forum can help or guide you.

But, let's see what Elastic answers.

5

To clarify the timeline: while the faculty officially lists "June, July, or August," in about 90% of cases, they schedule the defenses right at the end of June (around June 27th–29th). Rare exceptions push it later.

Because of this, a window from late May to late July would perfectly cover the highest-probability dates for my defense, including the intense preparation weeks right before it.

Since Elastic already offers a 30-day trial with the option to request a 30-day extension later, my goal was simply to see if they could grant them together as a continuous 60-day block. This would give me peace of mind during the critical June deadline without having to request a second extension in the middle of my final exams.

But as you said, let's see if anyone from the Elastic team responds. I really hope one of the Elastic admins sees this and can reply very soon!

Thanks for the solid advice on the snapshots and Docker.

6

This entire case if (unfortunately) pretty similar to Request for Elastic Security Free Trial Extension for SOC PoC Internship Project

There's no great solution to this right now but let me see if we can figure something out.

In the meantime, figuring out an automated way to recreate the environment with a new trial is probably the safest bet.

PS: If you do a full snapshot restore with the cluster metadata, you are IMO not able to do another trial (on the same major version). Haven't tested it in a while but I think that trial state is kept in the metadata.