Measured event size · Managed endpoint

CarbonBlack log size: 500 bytes per event

The average CarbonBlack event is 500 bytes, measured from samples of its logs. A managed endpoint source typically produces 10 events per second per device, bursting to 100: detections only is far lower, full telemetry far higher. The rate is an informed estimate; the size is measured.

What that comes to

One device, raw bytes, at the typical rate for a managed endpoint source.

A day of CarbonBlack logs from one device at the category's typical rate, 432 MB, is about 6 times an hour of Spotify.

Size your own

Raw bytes, before compression, indexing overhead and replication.

Measure a sample of your own

The figure above is an average; yours will differ, and for CarbonBlack what moves it most is this: detections only is far lower, full telemetry far higher. The profiler reads a sample from CarbonBlack in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.

Other managed endpoint sources

• Crowdstrike540 B
• Tanium500 B
• Mac OS145 B

The managed endpoint category: its typical rate and every source in it →