SIEM Storage Requirement Calculator
Size hot, warm and cold SIEM tiers from EPS, event size and retention, then price the whole estate per month.
About SIEM Storage Requirement Calculator
The retention seconds are what drive the number: EPS × bytes × 86,400 gives raw bytes per day, and each tier multiplies that by its own day count. Hot and warm carry the index and the replicas; cold is a compressed archive with neither, which is why 275 days of cold often costs less than 30 days of hot. Storage is usually the second-largest line in a SIEM budget after licensing, and tiering decisions made at design time are what decide whether a year of retention costs six figures or seven.
Formulas
SIEM Storage Requirement
Tier TB = EPS × bytes/event × 86,400 × days × (1 + index overhead) ÷ compression × replicas ÷ 1,000, summed across hot, warm and cold.
- EPS
- Sustained events per second
- index overhead
- Searchable index cost, applied to hot and warm only
- compression
- 6–10× on text logs
- replicas
- Copies held in the searchable tiers
Tiered cost
Monthly cost = Σ (tier GB × tier price per GB-month), with cold priced 5–10× below hot.
- tier GB
- Stored gigabytes in each tier
- tier price
- Published per-GB-month rate for that storage class
Worked example
With the default values below, SIEM Storage Requirement Calculator returns Total Storage Required of 29.16. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Sustained EPSaccepts 0–10,000,000 EPS
- 6,000 EPS
- Average event sizeaccepts 32–65,536 bytes
- 900 bytes
- Hot tier retentionaccepts 0–3,650 days
- 30 days
- Warm tier retentionaccepts 0–3,650 days
- 60 days
- Cold or archive retentionaccepts 0–3,650 days
- 275 days
- Compression ratioaccepts 1–20 ×
- 8 ×
- Index overhead on hot and warmaccepts 0–100 %
- 25 %
- Replicas on hot and warmaccepts 1–6 copies
- 2 copies
- Hot tier priceaccepts 0–10 $/GB-month
- 0.23 $/GB-month
- Warm tier priceaccepts 0–10 $/GB-month
- 0.1 $/GB-month
- Cold tier priceaccepts 0–10 $/GB-month
- 0.023 $/GB-month
Results
- Total Storage Required
- 29.16 TB
- Hot Tier
- 4.37 TB
- Warm Tier
- 8.75 TB
- Cold Tier
- 16.04 TB
- Raw Ingest per Day
- 466.56 GB/day
- Monthly Storage Cost
- $2,250
- Annual Storage Cost
- $26,996
Step by step
- 1Values used
- 2SIEM Storage Requirement
- 3Tiered cost
- 4Total Storage Required= 29.16 TB
- 5Hot Tier= 4.37 TB
- 6Warm Tier= 8.75 TB
- 7Cold Tier= 16.04 TB
- 8Raw Ingest per Day= 466.56 GB/day
- 9Monthly Storage Cost= 2,250
Assumptions and limits
- The result is derived only from the 11 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is SIEM Storage Requirement calculated?
Tier TB = EPS × bytes/event × 86,400 × days × (1 + index overhead) ÷ compression × replicas ÷ 1,000, summed across hot, warm and cold. The retention seconds are what drive the number: EPS × bytes × 86,400 gives raw bytes per day, and each tier multiplies that by its own day count. Hot and warm carry the index and the replicas; cold is a compressed archive with neither, which is why 275 days of cold often costs less than 30 days of hot.
Why does SIEM Storage Requirement matter?
Storage is usually the second-largest line in a SIEM budget after licensing, and tiering decisions made at design time are what decide whether a year of retention costs six figures or seven.
What values do I need to enter?
This calculator takes 11 inputs: Sustained EPS, Average event size, Hot tier retention, Warm tier retention, Cold or archive retention, Compression ratio, Index overhead on hot and warm, Replicas on hot and warm, Hot tier price, Warm tier price, Cold tier price. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why does cold storage skip the index overhead?
Archived data is stored as compressed raw segments and rehydrated on demand, so no term index is maintained. That is also why searching it takes minutes to hours instead of seconds.
What compression ratio should I assume?
Start at 6× if you have measured nothing — that is conservative for mixed text logs. Well-tuned columnar formats on repetitive firewall data reach 10–12×, but JSON-heavy cloud audit logs with high-cardinality fields often stall around 5×.