Theroretically there is some "Recommended Capacity Values" in the Specification Sheet, "Based on typical network environments using average event and flow aggregation".
For ERC-4600 there is 24000EPS limit, and for ETM-5600 - 60000EPS limit. Typical (...) aggregation means around 10:1, so you can safely feed your ESM by 6000 aggregated events per second. You can use many of ERCs, but you should remeber about this ESM's limit.
There is no good answer for your question, because it is not easy to say something about real aggregation level in your environment.
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.
Community Help Hub
New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.