SIEM ingest volume sizer

You enter headcount, endpoints, firewalls, cloud workloads, and bolt-ons. You get a daily GB envelope plus a 40% incident-burst buffer.

Rule of thumb is 1-2 MB/employee/day for general user telemetry. This sizer uses 1.5 MB/employee/day plus 0.3 MB/endpoint/day plus 8 GB/firewall/day plus 50 MB/cloud-workload/day. Add bolt-ons for O365 (1 MB/user/day) and Kubernetes (1.5 MB/workload/day). Source assumptions are Microsoft Sentinel billing reference and Splunk data-ingestion guidance.