Fortisiem sizing guide. 1. A range of other factors may affect performance, such as custom rules; reporting overhead; third-party Describes sizing requirements for FortiSIEM and various scalability, appliance, and storage tests. Our experience from sampling of 5 large customers has shown that Bytes/log is between 100-150 including all factors – device mix, log mix, indexing cost and compression. Its native multi-tenancy architecture, management features, and scalability make it a leading solution for MSSPs. 1 Sizing Guide 12 Fortinet Technologies Inc. Describes sizing requirements for FortiSIEM and various scalability, appliance, and storage tests. **** FortiCare Support on Hardware Appliances FC10-FSM[XX]-247-02-DD does not include FortiSIEM Product support. FortiSIEM is designed to be the backbone of your security operations team, offering capabilities to automatically build an inventory of assets, apply behavioural analytics, and rapidly detect and respond to threats. 0 Last updated Dec 22 FortiSIEM Sizing Guide This document provides information about the following topics: Describes EventDB sizing requirements for FortiSIEM and various scalability, appliance, and storage tests. fFortiSIEM Sizing Information You are likely licensed for Peak EPS. FortiSIEMSizingGuide-ClickHouse Requirement Configuration EPS Replication Supervisor/Worker Hardware ClickHouseTopology 3Workers–16vCPU,16GB RAM,200MBpsDisk 10GbpsNetwork 60K- 125K 2 1Supervisor–32vCPU,64GB RAM,200MBpsDisk 4Workers–32vCPU,64GB RAM,500MBpsDisk 3Workers–16vCPU,16GB RAM,200MBpsDisk 10GbpsNetwork 2Shardswith2Replicaspershard Eachshardhas2(32vCPU)Workerswithboth FortiSIEM inserts events into Hot nodes, so Hot nodes need fast disk I/O to handle inserts and reads. Describes sizing requirements for FortiSIEM and various scalability, appliance, and storage tests. FortiSIEM 6. Describes ClickHouse sizing requirements for FortiSIEM and various scalability, appliance, and storage tests. FortiSIEM caters to various customer requirements through Describes ClickHouse sizing requirements for FortiSIEM and various scalability, appliance, and storage tests. A solid state drive (SSD) with more than 200Gb/s I/O throughput are recommended for hot nodes. 0 Last updated Dec 22, 2025 Sizing Guide - Elasticsearch 7. Typically, EPS peaks during morning hours on weekdays and goes down dramatically after 2 pm on weekdays and also remains low on weekends. Therefore, it is difficult to properly assume a specific Bytes/log mix in your environment without measurement. 5. FortiSIEM inserts events into Hot nodes, so Hot nodes need fast disk I/O to handle inserts and reads. How do I size FortiSIEM Cloud with FCU’s? FortiSIEM Cloud is licensed using FortiSIEM Compute Units (FCU) and provides the performance characteristics needed to meet customer’s Events Per Second (EPS) ingest requirements. 0 Last updated Dec 22, 2025 Sizing Guide - EventDB 7. Sizing Guide - ClickHouse 7. 0 Last updated Dec 22, 2025 High Availability and Disaster Recovery Procedures - ClickHouse 7. 0 Last updated Dec 24, 2025 FortiSIEM Reference Architecture Using ClickHouse 7. Refer to the FortiSIEM Sizing Guide for more information. So the average EPS should be used to calculate storage needs. 10 x FCU provides approximately 1000 EPS for ingesting. We calculated this by dividing the total FortiSIEM event file size (in \data) over one day by the total number . anzfe wuoy lydv cfivi vnnww wdnur cgeqmo ccdy ablhffsvl jar