Event banner
Copilot for Security: Customize your Copilot
Event details
Explore some of the latest ways to customize Microsoft Copilot for Security for your team. Now generally available, Copilot is the generative AI-powered assistant for daily security operations, and it is more effective when integrated with your workflows. We'll start with a deep dive and walk you through creating custom promptbooks, adding your organization's knowledge bases, and using logic apps to write back updates to your tools. We'll then transition into Ask Microsoft Anything (AMA) so post your questions early and often!
This session is part of the Microsoft Secure Tech Accelerator. Add it to your calendar, RSVP for event reminders, and post your questions and comments below! This session will also be recorded and available on demand shortly after conclusion of the live event. |
94 Comments
- marvnl15Copper ContributorHoe can I calculate how much SCU my organization need in best practice. Microsoft advice 3 SCU's already, which is 8.6K per month already. With these prices we really need to know what we are going to pay for. The justification of the calculation can help with this.
- AlfredWangOccasional Reader
I saw example from Microsoft of usage monitoring. If its really around 40 SCU per hour, as per the screenshot, that will be over $100k monthly……
- I do not think that we have Best Practices acctually, but here is a great post on LinkedIn by Jurate (from MSFT Denmark) how to check it: https://www.linkedin.com/posts/jurateb_microsoft-events-activity-7180918064023027712-3diU?utm_source=share&utm_medium=member_desktop Quote ":gear: How many SCU do I need to buy? :chart_increasing: The number of SCUs you require depends on your usage. We recommend starting with 1-3 SCUs and testing it for one hour. If you need more, you can easily purchase additional SCUs via our portal, and they will be available within minutes. 🕒"
Can we stop Copilot for Security compute (SCU) instance when not using prompts and then turn it on when we need to use it to save on costs? Thanks!
- jdoz22Copper Contributor
It doesn't work that way I believe it is always on.
- This is why I asked my question about finding the SCU in Azure, but the team misunderstood the question
- "Estimate of the monthly bill is for 1 SCU provisioned for 24 hours daily for the entire month. SCUs are provisioned per hour and billed monthly". It is AlwaysOn feature with no serverless option for now as I understand
- Steve EnsBrass ContributorIf nobody else has commented on wanting a clippy tshirt yet....let me be the first.
- Trevor_Rusher
Community Manager
That concludes our presentation. Now on to Ask Microsoft Anything (AMA)! Keep your questions coming. Our experts will be answering some questions live on camera and others will follow up here in the Comments. Thanks!
- Fish_TacosBrass ContributorHow do I get one of them SWEET Clippy T-Shirts that Ryan has on? 3XLT.
- JHandlerCopper ContributorI missed the first 15 minutes of the presentation. How do I watch it on demand?
- Fish_TacosBrass ContributorIts on YT. https://www.youtube.com/watch?v=i0M7WOhZMH0
- sumanthbr23Copper ContributorCost model is based on SCU. Is it possible to throw some light on how 1 SCU maps to a real-world use case? For ex: x number of questions asked in chat for Security Operations.
- Char_CheesmanBronze Contributor
Thanks for participating in Copilot for Security: Customize your Copilot! For reference, the panel covered this topic at around 48:20.
- MFilipsFormer EmployeeSCUs are a variable unit of measure that take into account the type of prompts, data that needs reasoned in an incident or prompt, as well as full session context and other elements. The best way to estimate and see this is in the usage monitoring dashboard within the Copilot for Security standalone portal.
- sumanthbr23Copper ContributorThanks for the detailed explanation in the video. As a follow-up, what is the min recommended SCU we need to provision to start exploring the capabilities? Also, is it Pay-as-you-Go like if I use it for say 5 hours a day then will only be charged for that usage, or we need to pay for the entire month?
- Kevin_PidliskeyCopper ContributorCan you give us a breakdown of how SCU's are calculated for each query? I would like to understand how we can appropriately estimate cost/utilization. Knowing Microsoft recommends a minimum of 3 SCU's per deployment.
- sumanthbr23Copper ContributorIs there a ready integration with ServiceNow for incidents management from Copilot? Like using some of the functionalities shown in the demo with incidents in ServiceNow?
- klavalleeFormer EmployeeYes, there is a ready ServiceNow plugin for incident management in Copilot.
- JarrodPichaCopper ContributorDoes CfS require Sentinal as a SEIM or are there other options available?
- klavalleeFormer EmployeeHi Jarrod- no, Sentinel is not required. You can bring your own SIEM, but having your security tools connected is important to get the most value from Copilot.
- OOlukosi175Copper ContributorTo use CoPilot for Security, must I also be subscribed to Microsoft Sentinel/Defender for XDR?
- klavalleeFormer EmployeeHi Olanrewaju - no, you don't need to have or use Sentinel or Defender XDR. You can bring your own SIEM or XDR, but having your security tools connected is important to get the most value from Copilot.
- How to integrate security copilot with the SAP environment. With this, I can ask for security insights from my SAP environment.
- craigfreyman-msft
Microsoft
Copilot for Security can integrate with any third-party product. We have a number of partners committed to doing so but anyone can build a plugin to interface with third party products.