Manage usage of security compute units in Security Copilot

Artikkeli
12/05/2024

The usage monitoring dashboard provides a comprehensive view into various data dimensions to help you keep track of security compute unit usage in Security Copilot. You'll have visibility into the number of units used, the specific plugins employed during sessions, and the initiators of those sessions. The dashboard also allows you to apply filters and export usage data seamlessly. The dashboard includes up to 90 days of data, offering a robust window into recent activity.

How provisioned SCUs are billed

Copilot for Security is sold in a provisioned capacity model and is billed by the hour. You can provision Security Compute Units (SCUs) and increase or decrease them at any time. Billing is calculated on hourly blocks rather than by 60-minute increments and has a minimum of one hour. Any usage within the same hour is billed as a full SCU, regardless of start or end times within that hour. For instance, if you provision an SCU at 9:05 am, then deprovision it at 9:35 am, and then provision another SCU at 9:45 am, you'll be charged for two units within the 9:00 a.m. to 10:00 a.m. hour. Similarly, if you provision an SCU at 9:45 a.m., you'll only have 15 minutes to use it before it's no longer available, as SCUs are provided in hourly blocks from 9:00 a.m. to 10:00 a.m. To maximize usage, make SCU provisioning changes at the beginning of the hour. For more information, see Manage usage.

Monitor security compute units use

Copilot owners can view the usage over time within the Microsoft Security Copilot usage monitoring dashboard.

To view the usage dashboard:

Sign in to Security Copilot (https://securitycopilot.microsoft.com) and go to the Home menu > Owner settings.
Select Usage monitoring.
View the usage dashboard, which shows how many SCUs are consumed over a period of time by your Microsoft Security Copilot workloads.

Understand the data dimensions

Use the data dimensions to get a granular view of how SCUs are being used. The following table provides information on what each column represents and helps you interpret data accurately:

Column	Description	Examples/Types
Date	Date when the user initiated the session. Displayed in local time zone.	Sept 10, 08:30 AM
Units used	Number of SCUs used in the session.	.6
Initiated by	The user that initiated the session.	Ben Heppard
Session ID	A unique identifier for each Copilot session.	a123b456-789-1011-1c2-d12345678e99
Category	The format in which session was made. There are two category types: - Prompt - Promptbook	Prompt – A single prompt. Promptbook – A session related to a promptbook. For example, a user initiates "Script Analysis" promptbooks in which 5 prompts are called. Each prompt from promptbook call will have a category as "promptbook".
Type	The method used for the session. There are two invocation types: - Manual Action - Automated Action.	Manual Action – User triggered calls. A user must manually initiate. For example, a user types and submits prompt in prompt bar. Automated Action - Calls that are automatically initiated/scheduled. For example, incident summary, scheduled logic app, or scheduled promptbook.
Copilot experience	The user interface where the session was initiated from. Users can use the standalone interface, an embedded interface, or through LogicApps.	- Security Copilot portal (Standalone experience) - Copilot in Microsoft products (Embedded experience), for example, inside Microsoft Defender XDR. - Azure Logic Apps - Users can initiate Security Copilot workflows using Azure Logic Apps.
Plugin used	The plugin used in the session.	Microsoft Entra

Apply filters

Use filters to narrow down the displayed information in the dashboard. Applying filters can help you analyze relevant data without reviewing the entire data set.

Note

Currently, filters are only applied to the table and not the bar-graph.

Screenshot showing the usage monitoring dashboard filter button.

The following filters are available:

Copilot experience
Users
Plugins used
Type
Category

Important

Selecting a date range impacts the data shown in the table. For instance, choosing "Last 24 hours" and then selecting a filter, such as a specific user will display information related to that user from only the past 24 hours.

Selecting a bar in the graph filters the table to show information for that specific day.

Export data

Export usage dashboard data into Excel files for easier analysis, sharing, or offline access. Select the Export button on the corner of the dashboard.

Screenshot showing the usage monitoring dashboard export button.

Nearing and crossing security compute unit limit

When the usage in your organization is nearing the limit, you are notified of it when submitting the prompts. To avoid disruption, you can contact the Azure capacity owner or contributor to increase the security compute units or limit the number of prompts.

Experience when nearing security compute unit limit

When an analyst is in the middle of an investigation and the usage is nearing the provisioned capacity limit, a notification is displayed to the analyst in response to a prompt.

These notifications are also shown in Security Copilot embedded experiences.

The notification informs the analyst to contact the Azure capacity owner or contributor to increase the capacity or limit the number of prompts to avoid disruptions.

The notification allows the analyst to react before they run out of capacity.

Experience when security compute unit limit is exceeded

When the provisioned security compute unit is crossed, the analyst will see an error message stating that due to high usage in the organization Copilot can't respond to requests. Analysts can't submit additional prompts at this time. More capacity would become available in the next hour.

The analyst is asked to contact the Azure capacity owner or contributor to increase the provisioned SCUs.

This view only appears when your organization reaches 100% of capacity.

Update the provisioned security compute units (SCUs)

You can update provisioned security compute units in the Azure portal as well as the Security Copilot portal.

Azure portal required role: Azure capacity owner or contributor

Security Copilot portal required role: Azure capacity owner or contributor who are also Security Copilot owners.