The matrices that follow are designed as guidelines to assist readers in setting their own bench- mark requirements for SIEM system testing. While this is a benchmark checklist, readers must remember that benchmarking, itself, is governed by variables specific to each organization. For a real-life example, consider an article in eSecurity Planet, in which Aurora Health in Michigan estimated that they produced 5,000–10,000 EPS, depending upon the time of day. 4 We assume that means during the normal ebb and flow of network traffic. What would that load look like if it were under attack? How many security.
