Turn an EPS figure and a source mix into GB per day, wire bandwidth and annual raw volume using real average event sizes.
Event size varies by more than 6× across common sources, so a single average is misleading: 6,000 EPS of NetFlow is a fraction of the volume of 6,000 EPS of EDR telemetry. Weighting each source share by its real average size gives a mean event size, which multiplied by EPS and 86,400 gives daily bytes. GB/day is the unit most SIEM contracts, cloud egress bills and storage plans are denominated in, and mis-estimating the source mix is the single most common cause of a blown first-year licence.
SIEM Log Ingestion
GB/day = EPS × average event bytes × 86,400 ÷ 1,000,000,000, where the average event size is the share-weighted mean of the source types.
Enrichment and bandwidth
Enriched volume = raw volume × (1 + enrichment overhead); ingest bandwidth (Mbps) = EPS × bytes × 8 ÷ 1,000,000.
GB/day = EPS × average event bytes × 86,400 ÷ 1,000,000,000, where the average event size is the share-weighted mean of the source types. Event size varies by more than 6× across common sources, so a single average is misleading: 6,000 EPS of NetFlow is a fraction of the volume of 6,000 EPS of EDR telemetry. Weighting each source share by its real average size gives a mean event size, which multiplied by EPS and 86,400 gives daily bytes.
GB/day is the unit most SIEM contracts, cloud egress bills and storage plans are denominated in, and mis-estimating the source mix is the single most common cause of a blown first-year licence.
This calculator takes 6 inputs: Sustained EPS, Firewall and NetFlow share (~300 B/event), Windows Security share (~1.5 KiB/event), Web proxy and DNS share (~800 B/event), EDR telemetry share (~2 KiB/event), Parsing and enrichment overhead. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Vendors quote licence tiers and cloud storage in decimal GB (10^9 bytes), so this calculator matches the invoice. Divide by 1.074 if you need GiB for filesystem planning.
Almost never. Licences meter the raw volume presented at ingest; compression only reduces what you pay the storage vendor. Budget both numbers separately.