Determine the maximum size of event data before its ingested by a SIEM

Products

• Carbon Black EDR

Issue/Introduction

Is it possible to determine the maximum size of event data before its ingested into a SIEM like Splunk?

Environment

• Carbon Black EDR Server: All Supported Versions
• CB-Event-Forwarder: All Supported Versions

Resolution

No, the size of most event types are dynamic and the actual size of events cannot be predicted until they are being ingested by a SIEM.

Additional Information

• There is no "maximum" size to an event from the event forwarder. The maximum size is determined by several factors, notably command line length (for process start events) and file path lengths (for filemod, process start, registry modification, and other events). Therefore, we are presenting what we believe to be a 99% measurement of log message length - that is, we believe that 99% of messages through the event forwarder will be this length or smaller.
• There may be extreme outliers for notable cases, for example encoded Powershell command lines from attackers, and as the product includes future functionality, the lengths may increase due to additional fields and/or context. 
• The p99 (99th percentile) size for modload, netconn, filemod, childproc, and procstart messages are about 6KB each. The p99 size for procend and tamper messages are 2KB each. 
• Note that the biggest size drivers for the output data are the modload messages (about 36% of output volume), regmod (about 34% of output volume), filemod messages (about 15% of output volume), and crossproc messages (about 8% of output volume). The remaining ~7% represent the other data types.