Measured event size · Managed endpoint

Crowdstrike log size: 540 bytes per event

The average Crowdstrike event is 540 bytes, measured from samples of its logs. A managed endpoint source typically produces 10 events per second per device, bursting to 100: detections only is far lower, full telemetry far higher. The rate is an informed estimate; the size is measured.

What that comes to

One device, raw bytes, at the typical rate for a managed endpoint source.

A day of Crowdstrike logs from one device at the category's typical rate, 467 MB, is about 6 times an hour of Spotify.

Size your own

Raw bytes, before compression, indexing overhead and replication.

Measure a sample of your own

The figure above is an average; yours will differ, and for Crowdstrike what moves it most is this: detections only is far lower, full telemetry far higher. The profiler reads a sample from Crowdstrike in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.

Other managed endpoint sources

• CarbonBlack500 B
• Tanium500 B
• Mac OS145 B

The managed endpoint category: its typical rate and every source in it →