SA1.10 Cost Management

Logic App execution costs

Logic Apps on the Consumption plan charge per action execution. Every step in your Logic App — the trigger evaluation, each HTTP call, each condition check, each compose action, each For Each iteration — is one action execution.

The rate is approximately £0.000025 per action (£0.025 per 1,000 actions). This is so low that most SOC managers do not believe it until they see the Azure bill.

Real-world cost calculation for NE’s automation stack:

Enrichment playbook: 15 actions per run (trigger + 5 enrichment queries + 5 compose steps + comment + Teams + tag + 2 error handling). Runs on every incident: 500/day = 15,000 runs/month. Total actions: 225,000/month. Cost: £5.63/month.

Collection playbook: 12 actions per run. Runs on High/Critical incidents only: ~50/day = 1,500/month. Total actions: 18,000/month. Cost: £0.45/month.

Notification playbook: 8 actions per run. Runs on High/Critical: ~50/day = 1,500/month. Total: 12,000. Cost: £0.30/month.

Containment playbook: 20 actions per run (enrichment + conditions + VIP check + blast radius + containment + verification + notification). Runs on confirmed threats: ~5/day = 150/month. Total: 3,000. Cost: £0.08/month.

Total Logic App cost for 4 production playbooks: £6.46/month. Even with 10 playbooks at higher action counts and volume, the total stays under £60/month.

The Logic App Standard plan (fixed monthly cost, better performance) becomes cost-effective above approximately 10 million actions/month — far beyond any SOC’s automation volume. Stay on Consumption plan.

External API costs

The significant cost variable is not Logic Apps — it is the third-party APIs your playbooks call.

VirusTotal. The free tier allows 4 requests per minute and 500 per day. At 500 alerts/day, you exhaust the daily limit if every alert triggers an IP lookup. Options: (1) Use the free tier and implement caching — store lookup results in a Sentinel watchlist for 24 hours, check the watchlist before calling the API, only call VirusTotal for IPs not in the cache. This reduces API calls by 80%+ because the same attacker IP appears in multiple alerts. (2) Upgrade to VirusTotal Premium (~£700/month) for unlimited lookups. The premium tier is justified only for SOCs processing thousands of unique IOCs per day.

AbuseIPDB. The free tier provides 1,000 checks per day — sufficient for most SOCs. Premium (~£15/month) increases the limit to 5,000/day. The free tier is usually adequate if combined with caching.

Shodan. The free API has severe rate limits (1 request/second, limited endpoints). The membership (~£50/month) provides 100 queries/minute. Shodan enrichment is valuable but optional — VirusTotal and AbuseIPDB cover the most common enrichment needs.

Cost optimization through caching. A Sentinel watchlist can store the results of external API lookups. Before calling VirusTotal, the playbook queries the watchlist: “Has this IP been looked up in the last 24 hours?” If yes, use the cached result. If no, call the API and store the result in the watchlist.

Implementation: add a “Run query and list results” action before the VirusTotal HTTP action:

1
2
3

_GetWatchlist('TI-Cache')
| where IPAddress == "@{variables('CurrentIP')}"
| where LastLookup > ago(24h)

If the query returns results, skip the VirusTotal call and use the cached data. If no results, call VirusTotal and add the result to the watchlist with a “Add rows to watchlist” action.

This pattern reduces external API calls by 70-90% depending on how many repeated IOCs appear in your alerts. At NE, the same attacker IP (203.0.113.45) appeared in 35 alerts over one month — caching turns 35 VirusTotal calls into 1.

When automation rules replace expensive playbooks

Some automation actions do not need a Logic App at all. Automation rules are free — they execute within Sentinel’s platform at no additional cost. Before building a playbook, check whether an automation rule can accomplish the same goal:

Severity changes: automation rule (free) vs playbook that reads the incident and calls the Sentinel API to change severity (£0.00005 per execution). Trivial cost difference but the automation rule is simpler, faster, and does not require a Logic App resource.

Assignment routing: automation rule (free). No playbook needed.

FP auto-close with simple conditions: automation rule (free). If the FP pattern can be expressed as title/severity/rule name conditions, no playbook needed.

FP auto-close with data lookup: playbook required. If the FP pattern requires checking a watchlist (is this IP known-safe?), the lookup needs a KQL action in a Logic App. This is the minimum-cost playbook: trigger + query watchlist + close incident = 3 actions × 500 runs/month = 1,500 actions = £0.04/month.

The rule: use automation rules for simple actions. Use playbooks for actions requiring data lookup, API calls, or conditional logic. Every unnecessary Logic App action is a (tiny) cost and a (small) maintenance burden.

The business case — automation vs headcount

The cost comparison that convinces finance:

Option A: Hire a fourth analyst. Salary: £55,000. Employer NI: £6,000. Benefits: £5,000. Equipment: £2,000. Training: £3,000. Total year 1: £71,000. Total year 2+: £66,000/year. Capacity added: 8 hours/day = 48 additional alerts triaged at 10 minutes each. At 500 alerts/day, the queue deficit drops from 356 to 308. The deficit is still 62%.

Option B: Build automation. Logic Apps: £60/month = £720/year. External APIs (VirusTotal free + AbuseIPDB free + caching): £0/year. Analyst time to build (120 hours over 90 days at 25% of one analyst): £0 incremental cost (existing salary). Total year 1: £720. Total year 2+: £720/year + 4 hours/month maintenance.

Capacity recovered: 64 analyst-hours/day (SA0.1 calculation). The queue deficit drops from 356 to 0. Zero untriaged alerts. The three existing analysts shift surplus time to investigation, hunting, and detection engineering.

Option B costs 1% of Option A and delivers 100% queue clearance instead of 14% improvement. This is not a close comparison. Present the numbers in a one-page document with the heading “Automation Investment Proposal” and the subheading “£720/year to eliminate 356 untriaged alerts per day.”