| 1 | # CoPilot Repo Map |
| 2 | |
| 3 | ## Root |
| 4 | - `README.md` |
| 5 | High‑level product overview, install steps, and TLS notes. |
| 6 | - `docker-compose.yml` |
| 7 | Deployment stack for backend, frontend, MySQL, MinIO, MCP, and Nuclei. |
| 8 | - `.env.example` |
| 9 | Canonical list of backend environment variables and connector settings. |
| 10 | - `build-dockers.sh` |
| 11 | Build helper for Docker images. |
| 12 | |
| 13 | ## Backend Entry & Config |
| 14 | - `backend/copilot.py` |
| 15 | FastAPI app initialization, router mounting, startup/shutdown orchestration. |
| 16 | - `backend/settings.py` |
| 17 | Local env loading; legacy settings for SQLAlchemy URI. |
| 18 | - `backend/requirements.txt` |
| 19 | Backend dependencies including FastAPI, SQLModel, APScheduler, integrations. |
| 20 | |
| 21 | ## Database & Migrations |
| 22 | - `backend/app/db/db_session.py` |
| 23 | Async and sync SQLAlchemy engines, session management. |
| 24 | - `backend/app/db/db_setup.py` |
| 25 | DB creation, migrations, seeding, admin/scheduler user creation. |
| 26 | - `backend/app/db/db_populate.py` |
| 27 | Default connectors, integrations, roles, auth keys. |
| 28 | - `backend/alembic/` |
| 29 | Alembic migrations and config. |
| 30 | |
| 31 | ## Auth & Middleware |
| 32 | - `backend/app/auth/utils.py` |
| 33 | JWT auth, scopes/roles enforcement. |
| 34 | - `backend/app/auth/models/users.py` |
| 35 | User and role models. |
| 36 | - `backend/app/middleware/*` |
| 37 | License gating, logging, customer access control, exception handling. |
| 38 | |
| 39 | ## Core Routing |
| 40 | - `backend/app/routers/` |
| 41 | Route modules for every domain (connectors, agents, incidents, integrations, etc.). |
| 42 | |
| 43 | ## Scheduler & Jobs |
| 44 | - `backend/app/schedulers/scheduler.py` |
| 45 | APScheduler setup, job metadata, scheduling logic. |
| 46 | - `backend/app/schedulers/routes/scheduler.py` |
| 47 | API endpoints to list/update jobs. |
| 48 | - `backend/app/schedulers/services/` |
| 49 | Collectors and scheduled tasks (alert creation, Cato, Duo, Darktrace, etc.). |
| 50 | |
| 51 | ## Connectors (Platform Services) |
| 52 | - `backend/app/connectors/routes.py` |
| 53 | Connector CRUD and verification API. |
| 54 | - `backend/app/connectors/services.py` |
| 55 | Connector verification dispatch map and file upload handling. |
| 56 | - `backend/app/connectors/utils.py` |
| 57 | Shared DB lookup helpers for connectors. |
| 58 | - `backend/app/connectors/wazuh_manager/` |
| 59 | Wazuh Manager auth/token caching and request utilities. |
| 60 | - `backend/app/connectors/wazuh_indexer/` |
| 61 | Wazuh Indexer connection utilities. |
| 62 | - `backend/app/connectors/graylog/` |
| 63 | Graylog API helpers and routing. |
| 64 | - `backend/app/connectors/grafana/` |
| 65 | Grafana connection utilities and folder/datasource management. |
| 66 | - `backend/app/connectors/velociraptor/` |
| 67 | Velociraptor connection and API helpers. |
| 68 | - `backend/app/connectors/shuffle/` |
| 69 | Shuffle connection verification. |
| 70 | - `backend/app/connectors/event_shipper/` |
| 71 | GELF TCP logger for Graylog event shipping. |
| 72 | - `backend/app/connectors/portainer/` |
| 73 | Portainer connection utilities. |
| 74 | |
| 75 | ## Integrations (Per‑Customer) |
| 76 | - `backend/app/integrations/routes.py` |
| 77 | Customer integration CRUD and validation. |
| 78 | - `backend/app/integrations/models/customer_integration_settings.py` |
| 79 | Integration config and auth key models. |
| 80 | - `backend/app/integrations/modules/` |
| 81 | Data collection modules for Duo, Darktrace, Mimecast, Huntress, etc. |
| 82 | - `backend/app/integrations/copilot_mcp/` |
| 83 | MCP query routing (local and cloud services). |
| 84 | - `backend/app/integrations/nuclei/` |
| 85 | Web vulnerability assessment. |
| 86 | - `backend/app/integrations/scoutsuite/` |
| 87 | Cloud security assessment. |
| 88 | - `backend/app/integrations/github_audit/` |
| 89 | GitHub audit reports and metadata. |
| 90 | |
| 91 | ## Network Connectors |
| 92 | - `backend/app/network_connectors/routes.py` |
| 93 | Customer‑scoped “network connector” management and auth keys. |
| 94 | - `backend/app/network_connectors/models/network_connectors.py` |
| 95 | Network connector DB schema and relations. |
| 96 | |
| 97 | ## Provisioning |
| 98 | - `backend/app/customer_provisioning/services/` |
| 99 | Provision/decommission Graylog, Grafana, Wazuh, Portainer for customers. |
| 100 | - `backend/app/stack_provisioning/graylog/` |
| 101 | Graylog content packs, pipelines, streams, inputs templates. |
| 102 | |
| 103 | ## Incidents & SOC Features |
| 104 | - `backend/app/incidents/` |
| 105 | Incident alerts/cases, reports, tags, and case data store. |
| 106 | - `backend/app/agents/` |
| 107 | Wazuh/Velociraptor agents, SCA, vulnerabilities, data store. |
| 108 | |
| 109 | ## Data Store |
| 110 | - `backend/app/data_store/data_store_session.py` |
| 111 | MinIO client factory. |
| 112 | - `backend/app/data_store/data_store_setup.py` |
| 113 | Buckets for cases, templates, sysmon configs, Velociraptor artifacts. |
| 114 | |
| 115 | ## Active Response |
| 116 | - `backend/app/active_response/` |
| 117 | Active response routes and scripts (Windows/Linux). |
| 118 | |
| 119 | ## Threat Intel |
| 120 | - `backend/app/threat_intel/` |
| 121 | EPSS, VirusTotal, SOCFortress threat intel routes/services. |
| 122 | |
| 123 | ## Frontend (Admin UI) |
| 124 | - `frontend/src/router/index.ts` |
| 125 | Primary UI routes and feature pages. |
| 126 | - `frontend/src/api/endpoints/` |
| 127 | Typed API clients for backend endpoints. |
| 128 | - `frontend/src/components/` |
| 129 | Feature components: alerts, cases, agents, connectors, integrations, reports. |
| 130 | - `frontend/.env.example` |
| 131 | Vite environment defaults. |
| 132 | |
| 133 | ## Customer Portal |
| 134 | - `customer-portal/src/router/index.ts` |
| 135 | Customer portal routes (login, alerts, cases, agents). |
| 136 | - `customer-portal/src/views/` |
| 137 | Customer‑facing views with limited features. |