Based on the average size of an alert without packet, the following graph and table are provided to help you determine the database size required to store alert data for one year based on the number of alerts generated by your Sensors over a one week period.
Note
For comparison, generation of 10,000 alerts per week is low, while 1,000,000 alerts per week is high. If you are generating 1,000,000 alerts per week, it is recommended that you check your applied Trellix IPS policies to determine if you are applying a policy that is an "exact" match for your protected network environment.
Note
The following graph and table estimate size based on alerts both with and without associated packet logs. Thus, the size of alert data has been estimated from both lab and live environments.
.png "GUID-3A3ED527-112D-4DC6-9997-8B701CA851AD-low.png")
Alerts/Week | DB Size (One Year) in GB |
|---|---|
10,000 | 0.3 |
50,000 | 1.7 |
100,000 | 3.3 |
200,000 | 6.7 |
500,000 | 16.7 |
1,000,000 | 33.4 |
30,000,000 | 1002 |