SecOps Toolkit

SIEM Log Storage & Cloud Egress Cost Calculator

Estimate and compare the real total cost of ownership (TCO) for security log retention across cloud object storage and managed SIEM platforms. Model daily log ingestion, gzip/zstd compression ratios, hot vs. cold retention tiers, and data egress fees during incident response investigations.

How to Model Security Log Retention and Egress Costs

Security Operations Centers (SOC) and compliance frameworks (PCI-DSS, HIPAA, SOC 2, ISO 27001) typically mandate retaining audit logs for 90 days in hot searchable storage and up to 1–7 years in cold archive storage. While raw object storage appears inexpensive on paper, hidden costs in ingestion volume pricing, data retrieval fees, and network egress charges often dominate the monthly cloud bill.

1. The Impact of Log Compression Ratios

Raw text logs (JSON, Syslog, Windows Event XML, Nginx access logs) contain high redundancy. Compressing log batches using gzip or zstd (Zstandard) before writing to object storage typically achieves a 6:1 to 10:1 compression ratio:

  • Daily Compressed Volume: $\text{Compressed GB/day} = \frac{\text{Raw GB/day}}{\text{Compression Ratio}}$
  • Steady-State Storage: $\text{Stored GB} = \text{Compressed GB/day} \times \text{Retention Days}$

Note that while object storage providers (AWS S3, Cloudflare R2, Backblaze B2, Wasabi) bill strictly on the compressed bytes stored on disk, traditional SIEM platforms (such as Splunk Cloud or AWS CloudWatch Logs ingestion) bill based on the uncompressed raw volume ingested per day.

2. Egress and Retrieval Traps During Incident Response

Storing terabytes of logs in cold tiers like AWS S3 Glacier Flexible Retrieval reduces baseline monthly storage costs to ~$0.0036/GB. However, if your query engine or SIEM runs outside of the storage provider's network, rehydrating and transferring those logs triggers two separate charges: per-GB retrieval fees and standard internet egress fees ($0.09/GB on AWS). Zero-egress object storage providers like Cloudflare R2 and Wasabi (or Backblaze B2 within its 3x stored volume free egress allowance) eliminate network transfer penalties when querying logs from external compute clusters.

Frequently Asked Questions

What compression ratio should I use for JSON or Syslog data?
Standard newline-delimited JSON (NDJSON) and Syslog streams typically compress at a 7:1 to 10:1 ratio when grouped into 50–100 MB chunks using Zstandard (zstd) or Gzip. If logs are converted to columnar formats like Apache Parquet, compression and query efficiency improve even further.
When do cloud egress fees apply to log queries?
Egress fees apply whenever data is read from cloud storage and transmitted across the public internet or across different cloud regions—for example, if you store logs in AWS S3 (us-east-1) but run your search workers or Elastic/ClickHouse cluster on a separate provider or on-premises. If your compute instances run in the exact same AWS region via a VPC Endpoint, S3 transfer is free.
Why is Splunk Cloud significantly more expensive in the comparison table?
Managed SIEM platforms like Splunk Cloud bundle high-speed indexing compute, correlation engines, dashboards, and hot storage into an ingestion-based license (measured in GB/day of raw uncompressed data). Object storage rows (S3, R2, B2, Wasabi) represent the storage and transfer layer only, which teams pair with open-source query engines (such as DuckDB, ClickHouse, OpenSearch, or Vector).
What is the minimum storage duration penalty on S3 Glacier and Wasabi?
AWS S3 Glacier Flexible Retrieval and Wasabi enforce a 90-day minimum storage duration. If you delete or overwrite a log file after only 30 days, you are still billed for the remaining 60 days. For short-term rotation (under 30–60 days), use tiers without minimum duration requirements such as Cloudflare R2, Backblaze B2, or S3 Standard.
Can I customize the unit prices in this calculator?
Yes. Expand the Edit unit prices section below the comparison table to input your organization's custom Enterprise Discount Program (EDP) rates or regional pricing tiers. All calculations update instantaneously in your browser.