{"id":3026,"date":"2024-04-05T19:26:53","date_gmt":"2024-04-05T18:26:53","guid":{"rendered":"https:\/\/mortenknudsen.net\/?p=3026"},"modified":"2025-05-10T14:05:53","modified_gmt":"2025-05-10T13:05:53","slug":"copilot-for-security-scalable-capacity-management-for-non-24x7-soc-scenario","status":"publish","type":"post","link":"https:\/\/mortenknudsen.net\/?p=3026","title":{"rendered":"Security Copilot Scalable Capacity Management for non-24×7 SOC scenario"},"content":{"rendered":"\n

<\/p>\n\n\n\n

Background<\/h2>\n\n\n\n

Some of my customers are not having 24×7 SOC but still wants to utilize Microsoft Security Copilot during their normal workhours, typically Monday-Friday from 8am-4pm.<\/p>\n\n\n\n

During this time they want to have a scalable capacity with most capacity in the morning (peak) and then less capacity in the afternoon. When they go home, they want the capacity to be removed until next day at 8am. <\/p>\n\n\n\n

This scenario will decrease the cost for Security Copilot significantly as it is only running during their workhours.<\/p>\n\n\n\n

Disclaimer about pricing<\/h2>\n\n\n\n
\n

Since Microsoft Security Copilot came out April 1, 2024, I expect some fine-tuning of technical conditions and pricing along the way. Therefore the idea behind this method and price examples may change, if Microsoft introduces changes in price structure or technical conditions in the future.<\/p>\n\n\n\n

I recommend to monitor this webpage<\/a> to check out the latest about Microsoft Security Copilot.<\/strong><\/p>\n<\/blockquote>\n\n\n\n

<\/p>\n\n\n\n

Cost Calculator for Scalable Deployment of Capacity<\/a><\/h2>\n\n\n\n

This spreadsheet can be used to calculate the capacity cost for a non-24×7 SOC scenario, where Security Copilot is used with different sizing during the day (high, medium, low capacity usage) during for example 8am-4pm operation.<\/p>\n\n\n\n

Excel file – Cost Calculator<\/a><\/p>\n\n\n\n

Example of cost per month, based on peak in the morning with degrade of capacity requirement around noon. Capacity is removed at 4pm, when IT dept goes home. No 24×7 SOC.<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"image-20240405183838900\"\/<\/a><\/figure>\n\n\n\n

<\/p>\n\n\n\n

\n

NOTE: This spreadsheet doesn’t replace Microsoft Azure Price Calculator. Microsoft Azure Price Calculator<\/strong> contains latest on pricing and conditions for your region and environment.<\/strong><\/p>\n<\/blockquote>\n\n\n\n

Deployment scripts for Scalable Deployment of Capacity<\/a><\/h2>\n\n\n\n

Link to ZIP-file with all files<\/a><\/p>\n\n\n\n

Purpose<\/th>SCUs (sample)<\/th>File<\/th><\/tr><\/thead>
High
Gives highest amount of SCUs. Typically used in the morning for example from 8-10am, when security incidents are being analyzed (peak)<\/td>		4<\/td>DeploymentCopilot4Security
Capacity_SCU_High_Usage<\/td><\/tr>
Medium
Gives medium amount of SCUs. Typically used in the morning after initial security incident analysis for example from 10-11am<\/td>		2<\/td>DeploymentCopilot4Security
Capacity_SCU_Medium_Usage<\/td><\/tr>
Low
Gives lowest amount of SCUs. Typically used when peak for security analyses are over and normal security operation happens for example from 11am-4pm<\/td>		1<\/td>DeploymentCopilot4Security
Capacity_SCU_Low_Usage<\/td><\/tr>
Delete
Removes capacity, so there will be no capacity cost in off-hours where IT dept. works. Used in scenarios with no 24×7 Security SOC. This can run for example at 4pm when IT dept goes home.<\/td>		0<\/td>DeleteCopilotf4SecurityCapacity<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

NOTE: Remember to edit the amounts of SCUs and region in the files for your needs<\/p>\n\n\n\n

<\/p>\n\n\n\n

\"image-20240405185205986\"\/<\/a><\/figure>\n\n\n\n

Hopefully we will see a more smoother method in the future, instead of a delete+provision of capacity. <\/p>\n\n\n\n

Note: You don’t loose any prompt history, settings, permissions, etc. as it is kept for 90 days. It is only the capacity, which is being adjusted\/removed.<\/p>\n\n\n\n

<\/p>\n\n\n\n

Automation of Capacity Change<\/h2>\n\n\n\n

<\/a>You can automate the configuration using any method like Scheduled Tasks software like Task Scheduler, VisualCron – or Azure Function or LogicApps. <\/p>\n\n\n\n

Aaron Hoffman made a great article on how to to this in LogicApp here<\/a><\/p>\n\n\n\n

Below is an example of doing this as 4 jobs using VisualCron (Advanced Task Scheduler)<\/p>\n\n\n\n

\"image-20240405184741166\"\/<\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"

Background Some of my customers are not having 24×7 SOC but still wants to utilize Microsoft Security Copilot during their … <\/p>\n

Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":3040,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"ngg_post_thumbnail":0,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[56,134,132,58],"tags":[],"class_list":["post-3026","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-m365-security","category-mvpbuzz","category-security","category-sentinel","infinite-scroll-item","resize-featured-image"],"featured_image_src":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/04\/2024-04-05_20-44-53.jpg","author_info":{"display_name":"Morten Knudsen","author_link":"https:\/\/mortenknudsen.net\/?author=1"},"jetpack_featured_media_url":"https:\/\/mortenknudsen.net\/wp-content\/uploads\/2024\/04\/2024-04-05_20-44-53.jpg","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/3026","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3026"}],"version-history":[{"count":22,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/3026\/revisions"}],"predecessor-version":[{"id":5040,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/posts\/3026\/revisions\/5040"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=\/wp\/v2\/media\/3040"}],"wp:attachment":[{"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3026"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3026"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mortenknudsen.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3026"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}