SIEM ingest savings calculator
Model what edge reduction could take off your SIEM ingest bill.
Three inputs, one formula. Replace each default with your own figures: the defaults are illustrative assumptions, not benchmarks or market prices.
In short
The DPLens SIEM ingest savings calculator multiplies the GB/day you stop sending by your annual SIEM cost per GB/day of ingest. DPLens is a UK-built, self-hosted log collection and security data pipeline agent for Windows that does that reduction on the host, before the SIEM bills it. The result is only as good as your inputs, so treat it as a model to refine, not a quote.
Calculator
Set your own volume, reduction and cost
Drag the sliders. The daily volume runs from 10 to 4,000 GB/day, the reduction from 5% to 90%, and the rate from £20 to £900 a year per GB/day; outside those ranges, use the formula below.
What edge processing takes off the bill
Filtering, aggregation and routing happen before delivery, so reduction lands on your licence, not on a processing invoice. Move the sliders to your own figures: the defaults are illustrative assumptions, not a quote.
Assumptions
Replace every default with your own figure
Daily volume collected (default 800 GB/day)
How much your Windows estate sends to the SIEM on an average day. Take it from the system that bills you: in Splunk, the licence usage report; in other SIEMs, the ingest or data-volume dashboard. Use an average over a representative month, not a peak day.
Reduced at the edge (default 55%)
The share of that volume you would filter, aggregate or rate-limit before delivery. It depends entirely on your sources and your detection policy, so there is no typical figure to borrow. The 55% default is illustrative only. Start from a measured sample: take a day of events from a representative server, count them by Event ID, and mark which ones your detections and investigations actually use. Better still, install an evaluation agent on a test host. The console's Overview funnel shows events in and out of each stage, measured rather than estimated, and the Pipeline page shows output as a percentage of input.
Annual SIEM cost per GB/day of ingest (default £180)
What one GB of average daily volume costs you over a year. Derive it from your own contract: annual SIEM licence or ingest cost ÷ average GB/day. If storage or retention is also billed by volume, add its annual cost before dividing. If your contract quotes a price per single GB ingested, multiply that price by 365 to put it in the slider's units. The £180 default is an illustrative assumption, not a market price.
Method
The formula, and a worked example
Volume avoided each day is the daily volume multiplied by the reduction percentage. The annual saving is the GB/day avoided multiplied by the annual cost per GB/day; there is no separate ×365, because the rate is already annual. Volume delivered is what is left.
With the defaults:
- 800 GB/day × 55% = 440 GB/day avoided (shown as "Dropped or aggregated").
- 800 − 440 = 360 GB/day still delivered.
- 440 × £180 = £79,200 a year, which the calculator rounds to £79k.
The calculator rounds its result to the nearest thousand pounds, and shows millions to at most one decimal place, so use the formula when you need the exact number for a business case.
Using the result
Turning the number into a business case
- It is a gross figure. For a net saving, subtract your DPLens licence, which is priced per agent and per network source, with no per-GB ingestion cost. See pricing.
- Keep every detection. Drop only the events nothing depends on. Start with noisy Windows Security Event IDs and check each one against your detection content.
- Match it to your contract. The formula assumes cost scales in a straight line with volume. With workload- or compute-based SIEM pricing, tiered commitments or fixed-term contracts, plan the saving around your renewal.
- Confirm it on your own data. Your own events, through your own rules, give you the real reduction.
Send the link with your three inputs and the result, or a screenshot, and point finance at the method and notes above.
FAQ
Questions about the calculator
Where does the £180 default come from?
It is an illustrative starting point, not a market price or a quote. Replace it with your annual SIEM licence or ingest cost divided by your average GB/day.
How do I find my own reduction figure?
Measure it. Reduction depends on your sources and your detection policy, so the 55% default is illustrative. Count a sample of your own events by Event ID, or run DPLens on a test host with an evaluation licence and read the measured figure from the console.
Can DPLens show the real saving once it is running?
Yes. Set an ingest cost in the console's settings and the Overview and Pipeline pages show GB a day in, GB a day out and what the difference is worth, from measured traffic. The console's setting is the cost of a single gigabyte, a different unit from this page's rate: divide this page's annual cost per GB/day by 365 to get it.
How do I get a net saving?
Subtract your DPLens licence, priced per agent and per network source, from the result. See the licensing model or contact us for a quote.
See it on your own logs
Try DPLens on one Windows server before you talk to anyone.
Book a demo, or request an evaluation licence and install it on a test host. The documentation covers everything from requirements to Group Policy rollout.