Measured event size · SIEM
Stellar Cyber Interflow log size: 1,000 bytes per event
The average Stellar Cyber Interflow event is 1,000 bytes, measured from samples of its logs. A SIEM source typically produces 10,000 events per second per device, bursting to 50,000: a normalised feed from another platform. The rate is an informed estimate; the size is measured.
What that comes to
One device, raw bytes, at the typical rate for a SIEM source.
| Period | At 10,000 events/s | At the 50,000 events/s burst |
|---|---|---|
| An hour | 36 GB | 180 GB |
| A day | 864 GB | 4.3 TB |
| 90 days | 77.8 TB | 389 TB |
| A year | 315 TB | 1.6 PB |
A day of Stellar Cyber Interflow logs from one device at the category's typical rate, 864 GB, is about the size of a 405B model’s weights.
Size your own
Raw bytes, before compression, indexing overhead and replication.
Measure a sample of your own
The figure above is an average; yours will differ, and for Stellar Cyber Interflow what moves it most is this: a normalised feed from another platform. The profiler reads a sample from Stellar Cyber Interflow in your browser, line by line, one event per line, and reports the bytes per line to set against it. Nothing is uploaded.
Other SIEM sources
- Unified Data Model1,236 B
The SIEM category: its typical rate and every source in it →
Logcaliper, free on iOS, has these sizes and rates built in and sizes a whole list of sources at retention: storage, cluster capacity, nodes.