Adaptive resource provisioning for a multi-tenant distributed event data store

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by a processing resource, causes the processing resource to:

• maintain on behalf of each tenant of a plurality of tenants of a managed security service provider (MSSP), a distributed event data store, wherein for a given tenant of the plurality of tenants, the distributed event data store includes a plurality of partitions operable to store event data for a plurality of computer systems of a private network of the given tenant over a predetermined window of time, wherein each partition of the plurality of partitions includes a number of resource provision units (RPUs), each providing a predefined amount of storage and a predefined processing throughput;
• for the given tenant of the plurality of tenants, periodically determine a provisioning status for a current partition of the plurality of partitions of the distributed event data store of the given tenant;
• when the provisioning status indicates an under-provisioning condition exists, dynamically increase the number of RPUs to be used for a new partition to be added to the plurality of partitions for the given tenant by an adjustment ratio calculated based on the predetermined window of time and an actual amount of time it took for the current partition to be filled with the event data of the given tenant, wherein the adjustment ratio is the predetermined window of time divided by the actual amount of time it took for the current partition to be filled.

A system comprising:

• a processing resource;
• and
• a non-transitory computer-readable medium, coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to:
• maintain on behalf of each tenant of a plurality of tenants of a managed security service provider (MSSP), a distributed event data store, wherein for a given tenant of the plurality of tenants, the distributed event data store includes a plurality of partitions operable to store event data for a plurality of computer systems of a private network of the given tenant over a predetermined window of time, wherein each partition of the plurality of partitions includes a number of resource provision units (RPUs), each providing a predefined amount of storage and a predefined processing throughput;
• for the given tenant of the plurality of tenants, periodically determine a provisioning status for a current partition in a current predetermined window of time of the plurality of partitions of the distributed event data store of the given tenant;
• when the provisioning status indicates an under-provisioning condition exists, dynamically increase the number of RPUs to be used for a new partition to be added to the plurality of partitions for the given tenant by a first adjustment ratio calculated based on the predetermined window of time and an actual amount of time it took for the current partition to be filled with the event data of the given tenant, wherein the first adjustment ratio is the predetermined window of time divided by the actual amount of time it took for the current partition to be filled;
• and
• when the provisioning status indicates an over-provisioning condition exists, dynamically decrease the number of RPUs to be used for subsequent partitions added later in subsequent predetermined windows of time to the plurality of partitions for the given tenant by a second adjustment ratio calculated based on the predetermined window of time and an amount of time estimated to fill the current partition with the event data of the given tenant.

A computer-implemented method of dynamically provisioning a distributed multi-tenant event data store, the method comprising:

• maintaining, by a managed security service provider (MSSP), on behalf of each tenant of a plurality of tenants of the MSSP a distributed event data store, wherein for a given tenant of the plurality of tenants, the distributed event data store includes a plurality of partitions operable to store event data for a plurality of computer systems of a private network of the given tenant over a predetermined window of time, wherein each partition of the plurality of partitions includes a number of resource provision units (RPUs), each providing a predefined amount of storage and a predefined processing throughput;
• for the given tenant of the plurality of tenants, periodically determining a provisioning status for a current partition in a current predetermined window of time of the plurality of partitions of the distributed event data store of the given tenant;
• and
• when the determining indicates an over-provisioning condition exists, dynamically decreasing the number of RPUs to be used for a partition to be added later in a subsequent predetermined window of time to the plurality of partitions for the given tenant by an adjustment ratio calculated based on the predetermined window of time and an amount of time estimated to fill the current partition with the event data of the given tenant, wherein the adjustment ratio is the predetermined window of time divided by the amount of time estimated to fill the current partition.

A non-transitory computer-readable storage medium embodying a set of instructions, which when executed by a processing resource, causes the processing resource to:

• maintain on behalf of each tenant of a plurality of tenants of a managed security service provider (MSSP), a distributed event data store, wherein for a given tenant of the plurality of tenants, the distributed event data store includes a plurality of partitions operable to store event data for a plurality of computer systems of a private network of the given tenant over a predetermined window of time, wherein each partition of the plurality of partitions includes a number of resource provision units (RPUs), each providing a predefined amount of storage and a predefined processing throughput;
• for the given tenant of the plurality of tenants, periodically determine a provisioning status for a current partition in a current predetermined window of time of the plurality of partitions of the distributed event data store of the given tenant;
• and
• when the determining indicates an over-provisioning condition exists, dynamically decreasing the number of RPUs to be used for a partition to be added later in a subsequent predetermined window of time to the plurality of partitions for the given tenant by an adjustment ratio calculated based on the predetermined window of time and an amount of time estimated to fill the current partition with the event data of the given tenant, wherein the adjustment ratio is the predetermined window of time divided by the amount of time estimated to fill the current partition.