Project daily SOC alert volume from event rate and rule fire rate, after deduplication, suppression and correlation.
Rule fire rate is expressed per million events so it stays comparable as ingest grows. Deduplication and suppression are applied multiplicatively, because they act on the surviving stream in sequence rather than on the raw total independently. Alert volume is the input to every staffing, automation and tooling decision the SOC makes, and a queue above roughly 50 alerts per analyst per shift stops being triaged and starts being bulk-closed.
Alert Volume
Alerts/day = EPS × 86,400 ÷ 1,000,000 × alerts per million events × (1 − dedup) × (1 − suppression).
Per-analyst load
Alerts per analyst per shift = alerts/day ÷ (24 ÷ shift hours) ÷ analysts on shift.
Alerts/day = EPS × 86,400 ÷ 1,000,000 × alerts per million events × (1 − dedup) × (1 − suppression). Rule fire rate is expressed per million events so it stays comparable as ingest grows. Deduplication and suppression are applied multiplicatively, because they act on the surviving stream in sequence rather than on the raw total independently.
Alert volume is the input to every staffing, automation and tooling decision the SOC makes, and a queue above roughly 50 alerts per analyst per shift stops being triaged and starts being bulk-closed.
This calculator takes 7 inputs: Sustained EPS, Alerts raised per million events, Deduplication and aggregation reduction, Suppression by allow-lists and maintenance windows, Alerts grouped per case, Shift length, Analysts on shift. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
For a mature, tuned rule set, 5–20 alerts per million events. New deployments routinely start at 200+ because out-of-the-box content fires on normal administrative behaviour; the first ninety days of tuning is mostly about getting this number down two orders of magnitude.
It reduces case count, not alert count. Grouping 3.5 alerts into one case cuts the number of investigations an analyst opens, but the underlying alerts still have to be parsed, enriched and stored.