Calculate Next-Gen SIEM Ingestion Total
Calculates total NG-SIEM ingest by each Vendor (connector)
CQL · Falcon Next-Gen SIEMCopy query
// Exclude EDR logs, since these are in-platform and don't count against NG-SIEM ingest
#Vendor != "crowdstrike"
// Add up our fields that are counted for ingest (not 100% accurate, but very close to it)
| total_event := concat([@timestamp, @rawstring, #event.dataset, #event.module])
| length(field=total_event, as=event_size)
// Get our results by Vendor and translate to MB and GB
| groupBy([#Vendor], function=[sum(event_size, as=SizeBytes)], limit=max)
| SizeMB:=unit:convert("SizeBytes", binary=true, from=B, to=M, keepUnit=true)
| SizeGB:=unit:convert("SizeBytes", binary=true, from=B, to=G, keepUnit=true)
// Sort
| sort(SizeBytes, limit=200)
// Total for all vendors (uncomment for this)
//| sum(SizeBytes, as=SizeBytes)
//| SizeMB:=unit:convert("SizeBytes", binary=true, from=B, to=M, keepUnit=true)
//| SizeGB:=unit:convert("SizeBytes", binary=true, from=B, to=G, keepUnit=true)Calculates total NG-SIEM ingest by each Vendor (connector) Can be altered to trim to a single vendor and assist in locating areas of large ingestion usage, such as singular firewall policies. See this post for more information about doing this. No modules are required, but the NG-SIEM module is what facilitates the need for this query.
EDR/Endpoint/CrowdStrike native log sources are not included in this, as those are not counted against NG-SIEM ingest from a pricing perspective.
calculate_next_gen_siem_ingestion_total.yml
AAuraa
Monitoring
Network, Cloud, Other
2025-10-29
2025-10-29
