RESOURCES · CALCULATOR
Size your SIEM.
Estimate your log-ingestion footprint — EPS (events per second) and GB/day — from the data sources you actually run. Live, self-serve, no signup.
Translate EPS ↔ GB.
Use the workbook model directly. Convert ingestion rate into storage, or work backwards from GB/day to the EPS your platform must handle.
GB/day = EPS × event bytes × 86,400 ÷ 1,073,741,824Uses binary GB: 1 GB = 1,073,741,824 bytes.
YOUR ENVIRONMENT
What do you run?
Enter how many of each source type you have. Results update as you type.
| Source | Corporate | Production |
|---|---|---|
Endpoints / workstations Laptops, desktops, EDR agents 0.3 EPS per unit | ||
Servers Windows / Linux, physical & virtual 3 EPS per unit | ||
Firewalls Perimeter & internal firewalls 30 EPS per unit | ||
WAF Web application firewalls 20 EPS per unit | ||
Network devices Switches, routers, VPN concentrators 5 EPS per unit | ||
Cloud / SaaS sources AWS, Azure, GCP, M365, SaaS apps 2 EPS per unit | ||
Other sources Any additional log source type 1 EPS per unit | ||
Users Identity, auth & email logs 0.1 EPS per unit |
ESTIMATE
Your indicative sizing.
| Source | Units | Avg EPS |
|---|---|---|
| Total | 0 |
These defaults drive every calculation above. They are indicative, not a quote.
- · Average event size: 500 bytes
- · Peak factor: ×2
- · Per user: 0.1 EPS
- · Month: 30 days
- GB/day = total EPS × event size × 86,400 ÷ 1e9
Indicative sizing only — actual EPS varies by logging configuration, verbosity, and traffic. Talk to an engineer for a precise assessment.
Want a precise number?
A QMasters SOC engineer will validate these inputs against your real telemetry and recommend a right-sized plan.
Visit our homepage, dig into managed detection and response, or check out careers at QMasters next.
READY WHEN YOU ARE
Ready for Real Detection & Response?
Book a 30-minute working session with a SOC engineer. Bring your alerts.