Data source cost models. How much does your visibility cost?

Cost Justification. The Tough Questions.

Data Source Cost Models. Let’s Get Started!

Calculate SIEM Total Cost Of Ownership.

Index Alignment To Business Unit And Service.

Settings → (Data) Indexes
Settings → (Data) Indexes
Settings → (Data) Indexes
Data source with defined business unit and service

Evaluate the Data Source Usage.

index=_internal earliest=-1mon@mon latest=now source=*metrics.log splunk_server=”*” group=”per_index_thruput” 
series=”app1" OR “app2” OR “main” OR “sysmon” OR “winfw”
| eval GB=kb/1024/1024
| timechart span=1d sum(GB) as DailySumGB by series limit=0
Daily Data Source Amounts
Data Source Costs
Data Source Cost Allocation

Closing Remarks.

Dad, husband, cybersecurity practitioner, developer.