# SIEM Sizing Calculator: Ingest, Retention, and Hot vs Cold Storage Cost

> Source: https://netray.co/tools/siem-sizing-calculator
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Estimate annual SIEM license and storage cost from your events-per-second rate, daily ingest volume, and retention window split across hot and cold storage tiers.

## Category

erp-operations

## Tool

**Kind:** calculator

**Inputs:**

#### Sustained events per second (EPS)

**Key:** events_per_second

**Type:** number

**Default:** 8000

**Min:** 100

**Max:** 500000

**Step:** 100

**Unit:** EPS

**Help:** Peak sustained event rate across all log sources; many vendors still price partly on EPS tiers.

#### Daily log ingest volume

**Key:** daily_ingest_gb

**Type:** number

**Default:** 400

**Min:** 5

**Max:** 50000

**Step:** 5

**Unit:** GB/day

**Help:** Raw log volume ingested per day before compression, across all connected sources.

#### Total retention requirement

**Key:** retention_days

**Type:** number

**Default:** 365

**Min:** 30

**Max:** 2555

**Step:** 30

**Unit:** days

**Help:** Total days logs must be retained; many compliance frameworks require 1-7 years.

#### Hot (searchable) retention window

**Key:** hot_retention_days

**Type:** select

**Default:** 90

**Unit:** days

**Help:** Days kept in fast, immediately searchable storage; the remainder moves to cheaper cold/archive tiers.

**Options:**

##### 30 days hot

**Value:** 30

##### 90 days hot

**Value:** 90

##### 180 days hot

**Value:** 180

#### SIEM license cost per GB ingested

**Key:** license_cost_per_gb

**Type:** number

**Default:** 3.5

**Min:** 0.5

**Max:** 15

**Step:** 0.25

**Unit:** $/GB

**Help:** Blended per-GB ingest license cost; enterprise SIEM platforms commonly run $2-$6/GB depending on volume tier.

#### Hot storage cost

**Key:** hot_storage_cost_per_gb_month

**Type:** number

**Default:** 0.12

**Min:** 0.02

**Max:** 1

**Step:** 0.01

**Unit:** $/GB/mo

**Help:** Cost of fast, searchable storage per GB per month.

#### Cold/archive storage cost

**Key:** cold_storage_cost_per_gb_month

**Type:** number

**Default:** 0.02

**Min:** 0.002

**Max:** 0.2

**Step:** 0.005

**Unit:** $/GB/mo

**Help:** Cost of cold or archive-tier storage per GB per month for data beyond the hot retention window.

**Outputs:**

#### Annual ingest volume

**Key:** annual_ingest_gb

**Expr:** daily_ingest_gb * 365

**Format:** number

**Description:** Total log volume ingested per year at your current daily rate.

#### Cold retention window

**Key:** cold_retention_days

**Expr:** max(retention_days - hot_retention_days, 0)

**Format:** days

**Description:** Days of data held in cheaper cold or archive storage after the hot window.

#### Annual SIEM license cost

**Key:** annual_license_cost

**Expr:** annual_ingest_gb * license_cost_per_gb

**Format:** currency

**Description:** Ingest-based license cost for the full year at your current volume.

#### Annual storage cost (hot plus cold)

**Key:** annual_storage_cost

**Expr:** (daily_ingest_gb * hot_retention_days * hot_storage_cost_per_gb_month + daily_ingest_gb * cold_retention_days * cold_storage_cost_per_gb_month) * 12

**Format:** currency

**Description:** Storage cost across both tiers for your full retention window.

#### Total annual SIEM cost

**Key:** total_annual_siem_cost

**Expr:** annual_license_cost + annual_storage_cost

**Format:** currency

**Description:** Combined license and storage cost, the number to put in a budget request.

**Primary:** true

#### Total daily event volume

**Key:** events_per_day

**Expr:** events_per_second * 86400

**Format:** number

**Description:** Daily event count at your sustained EPS, useful for validating against vendor EPS-based pricing tiers.

**Disclaimer:** Planning estimate only. Actual SIEM pricing varies widely by vendor (ingest-based, EPS-based, or user-based) and by negotiated enterprise agreement discounts. Confirm against a specific vendor quote before budgeting.

## Content

**Intro:** This free SIEM sizing calculator estimates annual license and storage cost from your events-per-second rate, daily log ingest volume, and retention requirement, split across hot (searchable) and cold (archive) storage tiers. It is built for security engineers and IT directors scoping a new SIEM deployment or re-evaluating an existing one before a contract renewal. Enter your current or projected ingest volume and retention window, and the tool returns annual license cost, storage cost by tier, and total annual spend, the exact numbers vendors rarely make easy to estimate up front.

**Sections:**

#### Why SIEM cost surprises so many teams

**Body:** SIEM pricing models vary by vendor, ingest-based (per GB), EPS-based, or per-user, and ingest volume tends to grow faster than teams expect as new log sources (cloud infrastructure, SaaS applications, endpoint telemetry) get onboarded. A SIEM sized correctly at go-live frequently costs 40 to 60 percent more by year two simply from added log sources, not because the original sizing was wrong.

**Bullets:**

- Cloud infrastructure logging (especially detailed VPC flow logs) is the most common source of unplanned ingest growth.
- EPS-based pricing tiers can create sudden cost jumps at tier boundaries; model your growth curve, not just current state.
- Retention requirements are often set by compliance (PCI, HIPAA, CMMC) rather than security preference, so confirm the true minimum before sizing.

#### Hot vs cold storage: the lever most teams underuse

**Body:** Not all retained data needs to be instantly searchable. Most investigations and threat hunting queries target the last 30 to 90 days; older data is retained primarily for compliance and forensic purposes and can sit in cheaper archive-tier storage that takes longer to rehydrate for search. Splitting retention into a hot tier for active investigation and a cold tier for compliance archival typically cuts total storage cost by 60 to 80 percent versus keeping everything hot for the full retention period.

**Bullets:**

- A 90-day hot window covers the vast majority of real-world investigation and threat hunting needs.
- Cold storage costs 80 to 95 percent less per GB than hot, searchable storage.
- Confirm your SIEM platform's cold-tier rehydration time before committing to a tier split; some archival options take hours to search.

#### EPS is a sizing signal, not a cost driver by itself

**Body:** Events per second matters for real-time correlation and alerting performance, not directly for storage cost, which is driven by ingest volume in GB. Use EPS to validate that your SIEM's processing tier can keep up with peak load without alert delay, and use GB/day ingest for the actual license and storage cost math. Vendors that price purely on EPS tiers can create cost cliffs at specific thresholds; know your peak EPS precisely before signing a contract.

#### How Netray helps you size and deploy

**Body:** Netray helps manufacturers and defense contractors right-size SIEM deployments against actual log source growth, including on-prem and air-gapped SIEM architectures where cloud-hosted platforms are not an option for classified or ITAR-controlled environments. We benchmark your ingest projections against a 2-3 year growth curve before you sign a contract sized only for today.

**Cta:** Get a SIEM sizing benchmark that accounts for your log source growth over the next 24 months.

**Faq:**

#### How much does an enterprise SIEM cost per year?

**Answer:** For a mid-size enterprise ingesting 200-500 GB per day with a 1-year hot retention window, total annual cost including license and storage typically runs $400,000 to $1.2 million depending on vendor and negotiated pricing. Ingest-based pricing at $2-$6 per GB is the dominant model; EPS-based and per-user pricing exist but are less common for larger deployments.

#### What is a reasonable SIEM retention period?

**Answer:** Most compliance frameworks require 1 year minimum (PCI DSS), with some requiring longer: CMMC and defense contracts commonly require 1-3 years, and certain financial and healthcare regulations require up to 7 years. Set retention based on your specific compliance obligations first, then layer hot versus cold storage strategy on top to control cost.

#### Should I keep all retained logs in hot, searchable storage?

**Answer:** No, for most organizations. The majority of investigation queries target the last 30-90 days of data; older data retained for compliance rarely needs instant search. Splitting retention into a 90-day hot tier and a cold archive tier for the remainder typically cuts total storage cost by 60-80 percent with minimal impact on real-world investigation speed.

#### How do I estimate my daily log ingest volume before deploying a SIEM?

**Answer:** Run a discovery or trial ingest for 1-2 weeks across your planned log sources (firewalls, endpoints, cloud infrastructure, applications) using your SIEM vendor's sizing tool or a temporary log collector, then extrapolate to a full day and add 20-30 percent headroom for sources you plan to onboard later. Cloud infrastructure and endpoint telemetry are the most common sources teams underestimate.

## Search terms

SIEM sizing calculator, SIEM cost calculator, SIEM storage cost, events per second calculator, log retention cost, SIEM license pricing, SIEM ingest volume, security log storage budget

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json