Typical event rate · category

Windows workstation log rate: 5 events/s per device

A Windows workstation source typically produces 5 events per second per device, bursting to 50: assumes Sysmon; raw EDR telemetry is 10x. The rate is an informed estimate, a starting point for a sizing, not a measurement; the event sizes below are measured.

Measured sources in this category

Average bytes per event, measured, and one device's volume at the typical 5 events per second.

At the median size, a day from one device, 302 MB, is about 4 times an hour of Spotify.

Size a fleet

Raw bytes, before compression, indexing overhead and replication.

Measure a sample of your own

The figure above is an average; yours will differ, and for Windows workstation logs what moves it most is this: assumes Sysmon; raw EDR telemetry is 10x. The profiler reads a sample from Windows workstation logs in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.