Chapter 9: Calculator — NTA/AD Design Guide

📊 Calculator 1: Flow Storage Capacity Planner

Estimate the required storage capacity for NetFlow/IPFIX metadata based on your network throughput, number of monitored links, and desired retention period. Adjust the sliders to see real-time results.

Average Network Throughput (Gbps)

10

Gbps

Number of Monitored Links

5

links

Retention Period (days)

90

days

Flow Record Size

Avg Flows per Second per Gbps

2000

flows/sec/Gbps

Compression Ratio

Raw Flow Rate

—

flows/sec

Daily Storage (uncompressed)

—

GB/day

Daily Storage (compressed)

—

GB/day

Total Required Storage

—

TB

💾 Calculator 2: PCAP Storage Estimator

Calculate full-packet capture storage requirements based on monitored bandwidth, capture filter efficiency, and desired retention window. Includes deduplication and compression estimates.

Monitored Bandwidth (Gbps)

5

Gbps

Capture Filter Efficiency (%)

60

% of traffic captured

Retention Period (hours)

24

hours (1–168h / 1 week)

PCAP Compression

Deduplication Savings (%)

10

% reduction from dedup

Storage Overhead (RAID/FS)

Captured Data Rate

—

Gbps effective

Raw Storage/Hour

—

TB/hour

Net Storage Required

—

TB

Raw Disk Needed (w/ RAID)

—

TB raw

Storage Breakdown

Drive Configuration

🧠 Calculator 3: Sensor Throughput & CPU Sizing

Determine the required NTA sensor CPU cores and memory based on monitoring throughput, enabled detection features, and DPI depth. The gauge shows real-time CPU utilization estimate.

Peak Monitoring Throughput (Gbps)

10

Gbps

DPI Depth

ML Anomaly Detection

IDS/Signature Rules (thousands)

20

K rules

Concurrent Flow Table Size (M)

10

million concurrent flows

CPU Architecture

Required CPU Cores

—

physical cores

Required RAM

—

GB ECC

Recommended Platform

—

Estimated CPU Utilization

—

% at peak

Calculating...

CPU Load Breakdown

🚨 Calculator 4: Alert Volume & SIEM Ingestion Estimator

Estimate the daily alert volume and SIEM log ingestion rate based on your network size, detection rule count, and expected false-positive rate. Helps size SIEM licensing and SOC analyst capacity.

Number of Monitored Endpoints

5,000

endpoints

Active Detection Rules

100

rules

Avg Rule Trigger Rate (per endpoint/day)

0.05

triggers/endpoint/day

False Positive Rate (%)

70

% of alerts are false positives

Alert Correlation Reduction (%)

40

% reduction via correlation

Avg SIEM Event Size (bytes)

Raw Alerts/Day

—

alerts/day

True Positive Alerts/Day

—

actionable alerts

Post-Correlation Alerts/Day

—

incidents/day

SIEM Ingestion Rate

—

GB/day

Alert Funnel Visualization

💰 Calculator 5: NTA/AD ROI & TCO Estimator

Estimate the 3-year total cost of ownership (TCO) and return on investment (ROI) of an NTA/AD deployment, including hardware, software, operations, and avoided breach costs.

Cost Inputs

Benefit Inputs

ROI Results

Hardware Cost (USD)

One-time hardware purchase

Software License (USD/year)

Annual subscription/maintenance

Implementation & Training (USD)

One-time professional services

Annual Operations Cost (USD/year)

Staff time, power, rack space

SIEM License Increase (USD/year)

Additional SIEM ingestion cost

Annual Breach Probability (without NTA) %

15

% per year

Average Breach Cost (USD)

IBM Cost of Data Breach avg: $4.45M

NTA Breach Detection Improvement (%)

40

% reduction in breach probability

MTTD Reduction (days)

30

days faster detection

Cost per Day of Breach Dwell ($)

USD per day of undetected breach

Analyst Hours Saved/Month

80

hours/month (automation savings)

Analyst Hourly Rate (USD)

USD/hour fully-loaded cost

3-Year TCO

—

USD total

3-Year Total Benefits

—

USD total

Net 3-Year ROI

—

%

Payback Period

—

months