Sizing a SIEM: why events per second is only the start
Events per second drives licensing, but storage depends on event size too. At 3,500 events per second and 500 bytes per event, raw volume is about 151 GB a day, or roughly 13.6 TB over 90 days, before indexing, compression and replicas change the picture.
Plan retention in tiers: hot data for fast search, warm data for the rest of the investigation window, and cold archive for compliance. Add headroom for peaks and a growth scenario, such as 50 percent more sources.
Always validate with sample data from your own environment. Event sizes vary widely between firewalls, servers and applications, so a sizing based on assumptions can be wrong by a large margin.
Keep reading
What “local-only” should mean in a SOC
Many platforms claim on-premises operation yet still lean on the cloud. Three questions that reveal the difference.
12 November 2026 · 1 min read
Security operationsThe log source that stopped talking
A quiet dashboard is not always a calm network. How to catch the sources that go silent.
12 November 2026 · 1 min read
Security operationsAutomating response without losing control
Playbooks save time, but the wrong automation can cause outages. Where to keep a human in the loop.
6 November 2026 · 1 min read