SIEM Storage Requirement Calculator
Size hot, warm and cold SIEM tiers from EPS, event size and retention, then price the whole estate per month.
Inputs
300 B firewall, 800 B proxy, 1.5 KiB Windows Security, 2 KiB EDR.
Total Storage Required
29.16TB
Hot Tier
4.37TB
Warm Tier
8.75TB
Cold Tier
16.04TB
Raw Ingest per Day
466.56GB/day
Monthly Storage Cost
$2,250
Annual Storage Cost
$26,996
Step by step
Values used
Sustained EPS = 6,000 EPS; Average event size = 900 bytes; Hot tier retention = 30 days; Warm tier retention = 60 days; Cold or archive retention = 275 days; Compression ratio = 8 ×; Index overhead on hot and warm = 25 %; Replicas on hot and warm = 2 copies; Hot tier price = 0.2300 $/GB-month; Warm tier price = 0.1000 $/GB-month; Cold tier price = 0.0230 $/GB-month
SIEM Storage Requirement
Tier TB = EPS × bytes/event × 86,400 × days × (1 + index overhead) ÷ compression × replicas ÷ 1,000, summed across hot, warm and cold.
Tiered cost
Monthly cost = Σ (tier GB × tier price per GB-month), with cold priced 5–10× below hot.
Total Storage Required
= 29.16 TB
Hot Tier
= 4.37 TB
Warm Tier
= 8.75 TB
Cold Tier
= 16.04 TB
Raw Ingest per Day
= 466.56 GB/day
Monthly Storage Cost
= 2,250
How it works
The retention seconds are what drive the number: EPS × bytes × 86,400 gives raw bytes per day, and each tier multiplies that by its own day count. Hot and warm carry the index and the replicas; cold is a compressed archive with neither, which is why 275 days of cold often costs less than 30 days of hot. Storage is usually the second-largest line in a SIEM budget after licensing, and tiering decisions made at design time are what decide whether a year of retention costs six figures or seven.
Formulas
SIEM Storage Requirement
Tier TB = EPS × bytes/event × 86,400 × days × (1 + index overhead) ÷ compression × replicas ÷ 1,000, summed across hot, warm and cold.
- EPS
- Sustained events per second
- index overhead
- Searchable index cost, applied to hot and warm only
- compression
- 6–10× on text logs
- replicas
- Copies held in the searchable tiers
Tiered cost
Monthly cost = Σ (tier GB × tier price per GB-month), with cold priced 5–10× below hot.
- tier GB
- Stored gigabytes in each tier
- tier price
- Published per-GB-month rate for that storage class
Frequently Asked Questions
How is SIEM Storage Requirement calculated?
Tier TB = EPS × bytes/event × 86,400 × days × (1 + index overhead) ÷ compression × replicas ÷ 1,000, summed across hot, warm and cold. The retention seconds are what drive the number: EPS × bytes × 86,400 gives raw bytes per day, and each tier multiplies that by its own day count. Hot and warm carry the index and the replicas; cold is a compressed archive with neither, which is why 275 days of cold often costs less than 30 days of hot.
Why does SIEM Storage Requirement matter?
Storage is usually the second-largest line in a SIEM budget after licensing, and tiering decisions made at design time are what decide whether a year of retention costs six figures or seven.
What values do I need to enter?
This calculator takes 11 inputs: Sustained EPS, Average event size, Hot tier retention, Warm tier retention, Cold or archive retention, Compression ratio, Index overhead on hot and warm, Replicas on hot and warm, Hot tier price, Warm tier price, Cold tier price. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why does cold storage skip the index overhead?
Archived data is stored as compressed raw segments and rehydrated on demand, so no term index is maintained. That is also why searching it takes minutes to hours instead of seconds.
What compression ratio should I assume?
Start at 6× if you have measured nothing — that is conservative for mixed text logs. Well-tuned columnar formats on repetitive firewall data reach 10–12×, but JSON-heavy cloud audit logs with high-cardinality fields often stall around 5×.