Hi everyone.
Our company is migrating some workloads to the Cloud. So we are planning to use QRadar on-premises to monitor Amazon AWS and O365.
We are wondering what it might cost in terms of EPS.
so please, can someone share their experience with us on the average number of EPS used for Amazon AWS or O365 collection?

------------------------------
Famara Bodian
------------------------------

Famara,
sounds like an easy question. However getting no answer for 7 days means something! 1st of all: the bandwith of EPS rates depends on so many factors. Number of and type of services you are hosting in the cloud, audit policy and services you are using, number of users and VMs hosted etc. This makes it extremely difficult to come up with any answer. So if my answer would be 0.1 EPS or 1 EPS or 10 EPS all three would be true depending on your specification.
We are receiving logs from 33 different log sources in our QRadar life lab for our small company including AWS, O365 and MS Azure based services. EP rate per 24h is 2193 for AWS and 130 for O365. Does this help you? No, because there is no easy way to get EPS rate calculated. Best approach still is to run a PoC lab and measure whats coming in. From there you can extrapolate to your production scenario, e.g. from 2 test users to 2000 users or from 1 test VM in AWS to 50 VM.
BR
Karl

------------------------------
[Karl] [Jaeger] [Business Partner]
[QRadar Specialist]
[pro4bizz]
[Karlsruhe] [Germany]
[4972190981722]
------------------------------

Hi Karl, thank you for your answer. Effectively it seems difficult to predict EPS license usage with different environments.

------------------------------
Famara Bodian
------------------------------

Original Message:
Sent: Tue May 17, 2022 10:55 AM
From: Karl Jaeger
Subject: Amazon AWS and O365 EPS Estimation

Famara,
sounds like an easy question. However getting no answer for 7 days means something! 1st of all: the bandwith of EPS rates depends on so many factors. Number of and type of services you are hosting in the cloud, audit policy and services you are using, number of users and VMs hosted etc. This makes it extremely difficult to come up with any answer. So if my answer would be 0.1 EPS or 1 EPS or 10 EPS all three would be true depending on your specification.
We are receiving logs from 33 different log sources in our QRadar life lab for our small company including AWS, O365 and MS Azure based services. EP rate per 24h is 2193 for AWS and 130 for O365. Does this help you? No, because there is no easy way to get EPS rate calculated. Best approach still is to run a PoC lab and measure whats coming in. From there you can extrapolate to your production scenario, e.g. from 2 test users to 2000 users or from 1 test VM in AWS to 50 VM.
BR
Karl

------------------------------
[Karl] [Jaeger] [Business Partner]
[QRadar Specialist]
[pro4bizz]
[Karlsruhe] [Germany]
[4972190981722]
------------------------------