Calculating Data Ingestion for Google SecOps: Estimate costs

Planning your migration or rollout to Google Security Operations (formerly Chronicle SIEM & SOAR)? Here is how to estimate your data volume beforehand and prevent budget surprises.

The Refreshing Simplicity of Google SecOps Pricing

If you have spent any time with legacy SIEM platforms, you know the drill: license tiers based on events per second (EPS) peaks, add-ons for cold search, separate fees per analyst seat, and surprise overage penalties.

Whether you choose Standard, Enterprise, or Enterprise Plus (or Google Unified Security), Google SecOps simplifies cost predictability around two primary consumption pillars:

Gigabytes (GB) of logs ingested: Pricing across all packages is driven by the volume of data you ingest.
Security Tokens: A consumption metric used for autonomous Google security agents (such as auto alert triage in the Agentic SOC). Assistive Gemini capabilities—like natural-language search, investigation summaries, and playbook generation—are included without consuming tokens. (Enterprise Plus subscriptions even receive a complimentary daily token allotment!)

For everything else, you don’t have to worry about nickel-and-dime licensing:

No seat limits: Onboard your entire team—SOC analysts, detection engineers, and incident responders—without purchasing per-user licenses.
Unified Data Model (UDM): All incoming data is parsed and normalized into Google’s UDM, enabling lightning-fast search, context-aware analytics, and cross-source correlation across multi-cloud and SaaS environments.
No hidden platform caps: Run prebuilt SOAR integrations, build custom dashboards, and deploy detection rules (with unlimited Google Curated Detections in Enterprise tiers).
12 months of hot storage included: Across all packages, 365 days of telemetry is retained in hot, sub-second searchable storage by default—no archive hydration or cold-tier retrieval fees.

Why Calculating Ingestion Upfront is Critical

While the pricing model is delightfully predictable, it relies on one key input: how many GBs of telemetry do your environments actually produce per day?

In modern cloud environments—whether Google Cloud Platform (GCP), Amazon Web Services (AWS), or hybrid setups—log output can vary drastically. High-volume sources like VPC Flow Logs, Cloud DNS, audit logs, and load balancer access logs can generate terabytes if unmeasured, while application logs might only generate a few gigabytes.

The primary goal: Run estimation scripts before deploying so you have complete visibility and avoid any surprises afterwards.

By understanding your ingestion baseline:

You know exactly what your monthly and annual commitments look like.
You can filter out noisy, low-security-value logs before they hit your ingestion pipeline.
You can have a well-scoped discussion with your Google Cloud security specialist.

Estimating Google Cloud (GCP) Ingestion

To take the guesswork out of GCP log sizing, you can use the open-source gcp-secops-data-logging-ingest script.

This tool queries Cloud Monitoring metrics across your GCP Projects or Organization to calculate daily and monthly log volumes for common SecOps log types (Cloud Audit, VPC Flow Logs, Firewall Rules, Cloud NAT, Google Workspace, and more).

Quick Start: Running the GCP Script

1. Clone the repository:

git clone https://github.com/jorgecalo/gcp-secops-data-logging-ingest.git
cd gcp-secops-data-logging-ingest

2. Set up your environment: Ensure you have authenticated with your GCP account and set the target project or organization:

# Authenticate gcloud CLI
gcloud auth application-default login

# Install dependencies (if applicable)
pip install -r requirements.txt

3. Run the estimation:

python gcp_secops_ingest.py --project-id <YOUR_PROJECT_ID>

(You can also run it at the organization level or specify time windows—check the repository README for optional flags.)

The script will produce a structured breakdown detailing log volume by resource type, giving you daily averages and monthly totals in GB.

What About AWS Environments?

Security teams rarely live in a single cloud. If your workloads also span Amazon Web Services, you need the same level of predictability for CloudTrail, CloudWatch, VPC Flow Logs, and Route 53 telemetry.

We’ve got you covered there too: check out the companion tool aws-secops-data-logging-ingest.

It queries AWS CloudWatch metrics across your regions and accounts to aggregate log ingestion metrics, translating them into the exact GB numbers needed for a Google SecOps sizing exercise.

What to Do with the Output

Once you’ve run the scripts and generated your output report, share the output with your Google Cloud engineer or Google Partner.

They will plug your actual daily GB numbers and anticipated AI token usage into the sizing calculator to give you an accurate, tailored pricing indication without any guesswork.