Tools
SIEM Sizing Calculator: EPS, GB per Day and Log Storage
Almost every SIEM quote comes down to two numbers: how many events per second (EPS) your systems produce, and how many gigabytes of logs per day that turns into. Licences are usually priced on one of them, and storage is set by the second multiplied by how long you keep the logs. Count your log sources below, swap the starting rates for figures from your own systems where you have them, and the calculator works out average and peak EPS, daily ingest, and the hot and archive storage your retention period needs.
Your log sources
| Source | How many | Events per second, each |
|---|---|---|
| ServersWindows or Linux, physical or virtual | ||
| Laptops and desktopswith endpoint logs collected | ||
| Firewallsincluding VPN gateways | ||
| Switches, routers, Wi-Fiother network devices | ||
| Cloud usersMicrosoft 365, Google Workspace, SaaS sign-ins | ||
| Other sourcesEDR, email gateway, web proxy, apps |
The per-device rates are placeholder starting points, not measurements. Rates swing widely with audit policy, traffic and how much is filtered before it reaches the SIEM, so replace them with real counts from your own logs wherever you can.
Events and retention
How the calculation works
- Average EPS: each source count multiplied by its events per second, added together.
- Peak EPS: average EPS multiplied by your peak ratio. Use this for collector sizing and for licences sold in EPS bands.
- Events and GB per day: average EPS multiplied by 86,400 seconds, then by the average event size. 1 GB is taken as 1,000,000,000 bytes.
- Hot storage: GB per day multiplied by the hot retention days, stored uncompressed. Indexed platforms can use more than the raw size, so treat this as a floor.
- Archive storage: GB per day multiplied by the remaining retention days, divided by the compression ratio.
- Total: hot plus archive, topped up by your headroom percentage.
The weak point in any SIEM estimate is the per-device rate, not the sums. A domain controller with full auditing switched on can produce far more than a quiet file server, and a busy perimeter firewall that logs every allowed connection can dwarf the rest of the estate. The most reliable way to size is to send a week of logs from a sample of each source type to a trial instance, read the real EPS and GB per day, and put those figures into the table above.
Cutting the bill without losing visibility
If the daily ingest comes out higher than your budget, filter before you pay for it. Dropping allowed-traffic firewall logs for internal chatter, excluding verbose Windows event IDs your detections never use, and sending bulk logs straight to cheap archive storage rather than the hot tier are the usual first moves. Keep the logs that matter in an investigation: sign-ins, admin changes, remote access, endpoint alerts and email security events. Cyber insurers and incident responders ask for exactly those after a breach, and our RTO and RPO calculator and cyber security budget calculator help you weigh the spend against the rest of your security plan.
