Size hot, warm and cold SIEM tiers from EPS, event size and retention, then price the whole estate per month.
The retention seconds are what drive the number: EPS × bytes × 86,400 gives raw bytes per day, and each tier multiplies that by its own day count. Hot and warm carry the index and the replicas; cold is a compressed archive with neither, which is why 275 days of cold often costs less than 30 days of hot. Storage is usually the second-largest line in a SIEM budget after licensing, and tiering decisions made at design time are what decide whether a year of retention costs six figures or seven.
SIEM Storage Requirement
Tier TB = EPS × bytes/event × 86,400 × days × (1 + index overhead) ÷ compression × replicas ÷ 1,000, summed across hot, warm and cold.
Tiered cost
Monthly cost = Σ (tier GB × tier price per GB-month), with cold priced 5–10× below hot.
Tier TB = EPS × bytes/event × 86,400 × days × (1 + index overhead) ÷ compression × replicas ÷ 1,000, summed across hot, warm and cold. The retention seconds are what drive the number: EPS × bytes × 86,400 gives raw bytes per day, and each tier multiplies that by its own day count. Hot and warm carry the index and the replicas; cold is a compressed archive with neither, which is why 275 days of cold often costs less than 30 days of hot.
Storage is usually the second-largest line in a SIEM budget after licensing, and tiering decisions made at design time are what decide whether a year of retention costs six figures or seven.
This calculator takes 11 inputs: Sustained EPS, Average event size, Hot tier retention, Warm tier retention, Cold or archive retention, Compression ratio, Index overhead on hot and warm, Replicas on hot and warm, Hot tier price, Warm tier price, Cold tier price. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Archived data is stored as compressed raw segments and rehydrated on demand, so no term index is maintained. That is also why searching it takes minutes to hours instead of seconds.
Start at 6× if you have measured nothing — that is conservative for mixed text logs. Well-tuned columnar formats on repetitive firewall data reach 10–12×, but JSON-heavy cloud audit logs with high-cardinality fields often stall around 5×.