CSA (312-39) SOC Simulation Lab

Master SIEM capacity planning and data ingestion mechanics. In this simulation, you will step into the role of a SOC Engineer responsible for calculating infrastructure requirements for a new cloud SIEM deployment based on raw telemetry volume.

Scenario Context

TechNova Financial is migrating its on-premise logging infrastructure to a modern cloud-native SIEM (e.g., Microsoft Sentinel / Splunk Cloud). As the Senior SOC Analyst assisting the engineering team, you must determine the required licensing tier. SIEM licensing and ingestion nodes are heavily dependent on EPS (Events Per Second).

A junior analyst has pulled a 24-hour log generation report from the core network security stack but is confused about which data points should be used in the EPS calculation formula.

Security Environment

You review the 24-hour baseline log generation summary script output:

[SOC Ops] Ingestion Capacity Baseline - Past 24 Hours ====================================================== Data Source Total Count State ------------------------------------------------------ PaloAlto_FW_Traffic 43,200,000 Raw Logs WinEventLog_Security 17,500,000 Raw Logs CrowdStrike_EDR 4,100,000 Raw Logs ------------------------------------------------------ Total Log Volume: 64,800,000 events / 24hrs Post-Processing Metrics (SIEM Engine Estimates): - Expected Normalized Events: ~60,000,000 - Expected Correlated Alerts: ~150 ====================================================== Required Action: Calculate EPS to provision SIEM Receiver node.

Question

Which of the following formula is used to calculate the EPS of the organization?

SOC Hint: Think about the ingestion pipeline. Does a SIEM charge you based on the alerts it generates, or the sheer volume of logs you send to it before it does any processing?

Expert Insight

What is happening?

You are performing capacity planning for a SIEM deployment. SIEM infrastructure (whether determining the number of Log Collectors/Heavy Forwarders or calculating vendor licensing costs) scales based on the raw volume of data arriving at the ingestion layer. This is measured in Events Per Second (EPS).

Why C is correct

EPS = number of security events / time in seconds. EPS measures the sheer volume of raw security events generated by endpoint, network, and cloud devices and sent to the SIEM. In our scenario, you would calculate: 64,800,000 total events / 86,400 seconds = 750 EPS. This raw number dictates hardware, network throughput, and licensing.

Why the other options are wrong

Options A and D focus on correlated events. Correlation is the process where the SIEM takes millions of logs and matches them against detection rules to generate an alert. A SOC might ingest 750 EPS but only generate 2 correlated alerts per day. If EPS was based on correlated events, your licensing would be pennies, and your servers would crash from under-provisioning.

Option B focuses on normalized events. Normalization happens after ingestion (parsing the raw syslog into a common schema like CIM or ASIM). Some logs fail normalization. EPS measures what hits the front door, not what successfully parses.

MINI LESSON: The SIEM Data Pipeline

As a SOC analyst, understanding the order of operations in a SIEM is critical for troubleshooting missing logs or delayed alerts. The pipeline works in this specific order:

Generation (Raw Events): Firewalls, Windows DCs, EDR create raw logs. (This is where EPS is calculated).
Ingestion/Collection: Log forwarders, APIs, or Syslog servers receive the data.
Parsing/Normalization: The SIEM extracts fields (Source IP, User, Hash) from messy raw text into a standard database schema.
Indexing/Storage: The normalized data is written to disk so it can be searched quickly.
Correlation: Detection rules run against the normalized, indexed data to group suspicious activities into an Incident/Alert.

Ready to validate more SOC engineering and operational concepts?

Explore more CSA simulations