| 1 | # SOCFortress MDR |
| 2 | |
| 3 | Forward this customer's alerts to the SOCFortress MDR server. |
| 4 | |
| 5 | When deployed, every alert created in CoPilot for this customer is sent to the |
| 6 | MDR server (`POST /api/v1/alerts/copilot`). The MDR server then tasks the |
| 7 | customer's collector to fetch the authoritative document from the Wazuh Indexer |
| 8 | and runs its analysis. Alert status changes made in MDR are pushed back to |
| 9 | CoPilot automatically. |
| 10 | |
| 11 | ## Requirements |
| 12 | |
| 13 | - The MDR server must be reachable from CoPilot. Set `MDR_ENABLED=true` and |
| 14 | `MDR_SERVER_URL` (e.g. `https://mdr-server.socfortress.co:8443`) in CoPilot's |
| 15 | `.env`. |
| 16 | - The customer must have a registered collector on the MDR side. |
| 17 | |
| 18 | ## Auth keys |
| 19 | |
| 20 | | Key | Description | |
| 21 | | --- | --- | |
| 22 | | `COLLECTOR_UUID` | The MDR collector UUID assigned to this customer. Used to authenticate the alert hand-off to the MDR server. | |
| 23 | |
| 24 | ## Deploy |
| 25 | |
| 26 | After adding the integration with the customer's `COLLECTOR_UUID`, click |
| 27 | **Deploy**. Provisioning validates the collector UUID and marks the integration |
| 28 | active — no Graylog/Grafana resources are created (the MDR server pulls alerts |
| 29 | on demand via the collector). |