Alert Volume Calculator
Project daily SOC alert volume from event rate and rule fire rate, after deduplication, suppression and correlation.
About Alert Volume Calculator
Rule fire rate is expressed per million events so it stays comparable as ingest grows. Deduplication and suppression are applied multiplicatively, because they act on the surviving stream in sequence rather than on the raw total independently. Alert volume is the input to every staffing, automation and tooling decision the SOC makes, and a queue above roughly 50 alerts per analyst per shift stops being triaged and starts being bulk-closed.
Formulas
Alert Volume
Alerts/day = EPS × 86,400 ÷ 1,000,000 × alerts per million events × (1 − dedup) × (1 − suppression).
- EPS
- Sustained events per second
- alerts per million
- Rule fire rate, 5–20 for tuned content
- dedup
- Reduction from grouping identical alerts
- suppression
- Reduction from allow-lists and change windows
Per-analyst load
Alerts per analyst per shift = alerts/day ÷ (24 ÷ shift hours) ÷ analysts on shift.
- 24 ÷ shift hours
- Number of shifts covering the day
- analysts on shift
- Concurrent triage capacity
Worked example
With the default values below, Alert Volume Calculator returns Alerts per Day of 2,115. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Sustained EPSaccepts 0–10,000,000 EPS
- 6,000 EPS
- Alerts raised per million eventsaccepts 0–10,000 alerts/M events
- 12 alerts/M events
- Deduplication and aggregation reductionaccepts 0–99 %
- 60 %
- Suppression by allow-lists and maintenance windowsaccepts 0–99 %
- 15 %
- Alerts grouped per caseaccepts 1–100 alerts/case
- 3.5 alerts/case
- Shift lengthaccepts 4–24 hours
- 8 hours
- Analysts on shiftaccepts 1–200 analysts
- 3 analysts
Results
- Alerts per Day
- 2,115 alerts/day
- Raw Rule Fires per Day
- 6,221 fires/day
- Alerts per Hour
- 88.1 alerts/h
- Cases per Day After Correlation
- 604.3 cases/day
- Alerts per Analyst per Shift
- 235.0 alerts
- Total Noise Reduction
- 66.0%
- Volume Verdict
- Unmanageable — alerts will be closed unread
Step by step
- 1Values used
- 2Alert Volume
- 3Per-analyst load
- 4Alerts per Day= 2,115 alerts/day
- 5Raw Rule Fires per Day= 6,221 fires/day
- 6Alerts per Hour= 88.1 alerts/h
- 7Cases per Day After Correlation= 604.3 cases/day
- 8Alerts per Analyst per Shift= 235.0 alerts
- 9Total Noise Reduction= 66.0
Assumptions and limits
- The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Alert Volume calculated?
Alerts/day = EPS × 86,400 ÷ 1,000,000 × alerts per million events × (1 − dedup) × (1 − suppression). Rule fire rate is expressed per million events so it stays comparable as ingest grows. Deduplication and suppression are applied multiplicatively, because they act on the surviving stream in sequence rather than on the raw total independently.
Why does Alert Volume matter?
Alert volume is the input to every staffing, automation and tooling decision the SOC makes, and a queue above roughly 50 alerts per analyst per shift stops being triaged and starts being bulk-closed.
What values do I need to enter?
This calculator takes 7 inputs: Sustained EPS, Alerts raised per million events, Deduplication and aggregation reduction, Suppression by allow-lists and maintenance windows, Alerts grouped per case, Shift length, Analysts on shift. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
What is a realistic alerts-per-million rate?
For a mature, tuned rule set, 5–20 alerts per million events. New deployments routinely start at 200+ because out-of-the-box content fires on normal administrative behaviour; the first ninety days of tuning is mostly about getting this number down two orders of magnitude.
Does correlation reduce workload as much as deduplication?
It reduces case count, not alert count. Grouping 3.5 alerts into one case cuts the number of investigations an analyst opens, but the underlying alerts still have to be parsed, enriched and stored.