SIEM log volume estimator

SIEM platforms ingest logs from across an organisation's infrastructure and store them for detection, investigation, and compliance. The volume of data they receive — and store — has a direct impact on licensing costs, storage requirements, and query performance. This tool estimates ingestion volume from the number and type of log sources in an environment, using typical event rates drawn from real-world SIEM deployments. The compression estimate reflects the fact that most platforms compress log data before writing it to disk, typically achieving ratios of 8:1 to 12:1 depending on data type — structured JSON logs compress well, while raw syslog compresses less predictably. EPS (events per second) is included because it is the metric most SIEM vendors use to size and licence their platforms.