Score security log coverage from onboarded sources, critical source coverage and retention against requirement, with ingest and storage cost.
Coverage is weighted rather than counted because sources are not equal: identity, control-plane and network logs answer incident questions that application debug logs never will, so critical-source coverage carries 60% of the coverage component. Retention is folded in at 30% because logs you no longer hold are indistinguishable from logs you never collected. Every incident review ends with the same sentence — 'we do not have logs for that' — and the fix is cheap in advance and impossible afterwards, because logging is never retroactive.
Cloud Logging Coverage
Coverage score = (critical source coverage × 0.6 + all-source coverage × 0.4) × 0.7 + retention compliance × 0.3, where retention compliance = min(100, current ÷ required × 100).
Ingest and retention cost
Monthly cost = GB/day × 30 × ingest price + GB/day × retention days × storage price per GB per month.
Coverage score = (critical source coverage × 0.6 + all-source coverage × 0.4) × 0.7 + retention compliance × 0.3, where retention compliance = min(100, current ÷ required × 100). Coverage is weighted rather than counted because sources are not equal: identity, control-plane and network logs answer incident questions that application debug logs never will, so critical-source coverage carries 60% of the coverage component. Retention is folded in at 30% because logs you no longer hold are indistinguishable from logs you never collected.
Every incident review ends with the same sentence — 'we do not have logs for that' — and the fix is cheap in advance and impossible afterwards, because logging is never retroactive.
This calculator takes 9 inputs: Distinct log sources in the estate, Sources onboarded to the SIEM, Sources classified as security-critical, Security-critical sources onboarded, Current hot retention, Required retention, Log volume ingested, Ingest price per GB, Retained storage price per GB per month. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
No. Volume is a cost, coverage is the control. Ingesting a terabyte a day of application debug logs while the identity provider and the cloud control plane are not onboarded is the common and expensive failure. Get the critical sources in first, then trim volume from the noisy ones.
Tier it. Keep 30 to 90 days hot and searchable for detection and triage, then push the remainder to object storage with a query-on-demand engine. That typically cuts the cost of a one-year requirement by an order of magnitude while still satisfying the auditor.