Alert Volume Calculator
Project daily SOC alert volume from event rate and rule fire rate, after deduplication, suppression and correlation.
Inputs
A tuned enterprise rule set sits at 5–20; anything above 50 signals untuned content.
Alerts per Day
2,115alerts/day
Raw Rule Fires per Day
6,221fires/day
Alerts per Hour
88.1alerts/h
Cases per Day After Correlation
604.3cases/day
Alerts per Analyst per Shift
235.0alerts
Total Noise Reduction
66.0%
Volume Verdict
Unmanageable — alerts will be closed unread
Step by step
Values used
Sustained EPS = 6,000 EPS; Alerts raised per million events = 12 alerts/M events; Deduplication and aggregation reduction = 60 %; Suppression by allow-lists and maintenance windows = 15 %; Alerts grouped per case = 3.50 alerts/case; Shift length = 8 hours; Analysts on shift = 3 analysts
Alert Volume
Alerts/day = EPS × 86,400 ÷ 1,000,000 × alerts per million events × (1 − dedup) × (1 − suppression).
Per-analyst load
Alerts per analyst per shift = alerts/day ÷ (24 ÷ shift hours) ÷ analysts on shift.
Alerts per Day
= 2,115 alerts/day
Raw Rule Fires per Day
= 6,221 fires/day
Alerts per Hour
= 88.1 alerts/h
Cases per Day After Correlation
= 604.3 cases/day
Alerts per Analyst per Shift
= 235.0 alerts
Total Noise Reduction
= 66.0
How it works
Rule fire rate is expressed per million events so it stays comparable as ingest grows. Deduplication and suppression are applied multiplicatively, because they act on the surviving stream in sequence rather than on the raw total independently. Alert volume is the input to every staffing, automation and tooling decision the SOC makes, and a queue above roughly 50 alerts per analyst per shift stops being triaged and starts being bulk-closed.
Formulas
Alert Volume
Alerts/day = EPS × 86,400 ÷ 1,000,000 × alerts per million events × (1 − dedup) × (1 − suppression).
- EPS
- Sustained events per second
- alerts per million
- Rule fire rate, 5–20 for tuned content
- dedup
- Reduction from grouping identical alerts
- suppression
- Reduction from allow-lists and change windows
Per-analyst load
Alerts per analyst per shift = alerts/day ÷ (24 ÷ shift hours) ÷ analysts on shift.
- 24 ÷ shift hours
- Number of shifts covering the day
- analysts on shift
- Concurrent triage capacity
Frequently Asked Questions
How is Alert Volume calculated?
Alerts/day = EPS × 86,400 ÷ 1,000,000 × alerts per million events × (1 − dedup) × (1 − suppression). Rule fire rate is expressed per million events so it stays comparable as ingest grows. Deduplication and suppression are applied multiplicatively, because they act on the surviving stream in sequence rather than on the raw total independently.
Why does Alert Volume matter?
Alert volume is the input to every staffing, automation and tooling decision the SOC makes, and a queue above roughly 50 alerts per analyst per shift stops being triaged and starts being bulk-closed.
What values do I need to enter?
This calculator takes 7 inputs: Sustained EPS, Alerts raised per million events, Deduplication and aggregation reduction, Suppression by allow-lists and maintenance windows, Alerts grouped per case, Shift length, Analysts on shift. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
What is a realistic alerts-per-million rate?
For a mature, tuned rule set, 5–20 alerts per million events. New deployments routinely start at 200+ because out-of-the-box content fires on normal administrative behaviour; the first ninety days of tuning is mostly about getting this number down two orders of magnitude.
Does correlation reduce workload as much as deduplication?
It reduces case count, not alert count. Grouping 3.5 alerts into one case cuts the number of investigations an analyst opens, but the underlying alerts still have to be parsed, enriched and stored.