Every network has slight architectural differences that make each deployment unique. When deploying a network IPS, you must take into consideration the following factors when planning the capacity of your database:
Aggregate Alert and Packet Log Volume From All Sensors— What is the volume in your network? A higher volume will require additional storage capacity.
Lifetime of Alert And Packet Log Data— How long should you archive an alert? Maintaining your data for a long period of time (for example, one year) will require additional storage capacity to accommodate both old and new data.
The following subsections provide useful information for determining the necessary capacity for alerts and packet logs in your database.