SIEM storage estimator
Rough storage needs from event rate, event size, retention, and your own compression and overhead assumptions.
The values below are example inputs, not a recommendation. Replace them with numbers from your own environment.
How it works
The arithmetic: events per day = EPS × 86,400; raw size = events × average size; stored size = raw ÷ compression × (1 + overhead) × copies; total = stored per day × retention days.
This is not a vendor sizing tool. Real SIEM storage depends on how the product stores payloads and normalized records, its compression and indexing, and your data. In QRadar, for example, the most reliable input is the measured daily growth of the Ariel data on your own system; use that to calibrate the compression and overhead values here.
Results are shown in decimal units (GB, TB) and binary units (GiB, TiB), because disks are sold in one and operating systems often report the other.