Rex says
Money math without the spreadsheet headache. Plug in your numbers and I'll show you exactly where the dollars land.
Try a scenario
Click to load — tweak from there.Inputs
Result
Estimated monthly SIEM cost
$7,783
Estimated annual cost
$93,391
Total daily ingestion
100.0
Total monthly ingestion
3040
Hot-tier ingestion cost (monthly)
$6,992
Psst — share this and help Rex grow
One click, a permanent link with your numbers baked in.
How to use this
- 1Enter firewall/network logs.
- 2Enter endpoint/edr telemetry.
- 3Enter cloud/app audit logs.
- 4Enter other sources (dns, proxy, identity).
- 5Enter ingestion price per gb.
- 6Enter hot retention window.
- 7Enter cold/archive price as % of hot price.
- 8Read your estimated monthly siem cost on the right — it updates as you type.
- 9Hit Share to keep the scenario or send it to someone.
About this calculator
SIEM pricing is dominated by ingestion volume, and volume is dominated by a handful of noisy log sources: firewalls, DNS, endpoint telemetry, and cloud audit logs routinely account for 60-80% of total daily GB in a typical enterprise environment. This calculator estimates total daily and monthly log volume across your major sources, applies a per-GB ingestion rate common to consumption-priced platforms (Splunk, Sentinel, Chronicle-style pricing), and adds a retention cost multiplier since most platforms charge separately or at reduced rates for storing hot data beyond 30-90 days versus cold/archive storage. The output is meant for budget conversations and vendor negotiation prep: knowing your actual daily GB by source lets you push back on quotes, identify candidates for filtering or sampling before ingestion (like verbose DNS query logs), and decide what really needs 12 months of hot retention for compliance versus what can move to cheap cold storage after 90 days.
Worked example
Using the values the calculator loads with:
Inputs
- Firewall/network logs: 40
- Endpoint/EDR telemetry: 25
- Cloud/app audit logs: 15
- Other sources (DNS, proxy, identity): 20
- Ingestion price per GB: 2.3
- Hot retention window: 90
- Cold/archive price as % of hot price: 15
Results
- Estimated monthly SIEM cost: $7,783
- Estimated annual cost: $93,391
- Total daily ingestion: 100
- Total monthly ingestion: 3,040
- Hot-tier ingestion cost (monthly): $6,992
What each field means
Inputs
- Firewall/network logs
- The firewall/network logs used in the calculation. Starts at 40 so you have a working example on load.
- Endpoint/EDR telemetry
- The endpoint/edr telemetry used in the calculation. Starts at 25 so you have a working example on load.
- Cloud/app audit logs
- The cloud/app audit logs used in the calculation. Starts at 15 so you have a working example on load.
- Other sources (DNS, proxy, identity)
- The other sources (dns, proxy, identity) used in the calculation. Starts at 20 so you have a working example on load.
- Ingestion price per GB
- The ingestion price per gb used in the calculation. Starts at 2.3 so you have a working example on load.
- Hot retention window
- The hot retention window used in the calculation. Starts at 90 so you have a working example on load. Accepted range: 1–730.
- Cold/archive price as % of hot price
- The cold/archive price as % of hot price used in the calculation. Starts at 15 so you have a working example on load. Accepted range: 0–100.
Results
- Estimated monthly SIEM cost
- Returned as a money amount in US dollars and shown as the headline result. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Estimated annual cost
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Total daily ingestion
- Returned as a decimal number. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Total monthly ingestion
- Returned as a decimal number. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
- Hot-tier ingestion cost (monthly)
- Returned as a money amount in US dollars. It recalculates instantly whenever you change an input, so you can compare scenarios without reloading.
FAQ
Which log sources should I look at first to cut cost?
Firewall and DNS logs are usually the biggest and least valuable per-GB source since a huge share is routine allowed traffic; applying filtering to drop known-benign, high-volume, low-signal events (health checks, internal chatter) before ingestion commonly cuts 20-40% of total volume with minimal detection impact.
Why do vendors charge so much less for archive/cold storage?
Cold storage tiers trade query speed and immediate searchability for cost, data sits in cheaper storage and takes minutes to hours to rehydrate before you can search it, which is fine for satisfying a compliance retention requirement but not for active investigation, hence the split pricing model most platforms use.
How long do I actually need to keep logs hot?
Most active investigations and threat hunting reference the last 30-90 days; keep that window hot and searchable, then move older data to archive tier if you have a compliance requirement (PCI DSS requires 1 year, with 3 months immediately available) or your cyber insurance policy specifies a retention minimum.
Is per-GB pricing better or worse than per-node/per-user pricing?
It depends on your environment. Log-heavy but low-headcount environments (industrial, IoT-heavy, high-transaction-volume) often do better on per-node or flat-tier pricing, while typical office environments with moderate per-user log generation usually find per-GB more predictable and easier to control through filtering.
Accuracy and limitations
- Results are estimates before tax, fees, and inflation unless an input explicitly covers them.
- Rates are treated as fixed for the whole period — variable-rate products will drift from this projection.
- This is educational maths, not financial advice. Check anything contractual with the lender or your accountant.
Related tools
Cite this calculator
Writing about this topic? Grab a citation — every link helps keep these tools free.
RevenueLab. (2026). SIEM Log Ingestion Cost Calculator. Retrieved from https://www.revenuelab.fyi/toolbox/siem-log-ingestion-cost
<p>Source: <a href="https://www.revenuelab.fyi/toolbox/siem-log-ingestion-cost" target="_blank" rel="noopener">SIEM Log Ingestion Cost Calculator — RevenueLab</a> (2026).</p>
Source: [SIEM Log Ingestion Cost Calculator — RevenueLab](https://www.revenuelab.fyi/toolbox/siem-log-ingestion-cost) (2026).