| 1 | --- |
| 2 | title: Customer Portal |
| 3 | description: Optional customer-facing UI for MSSPs to share alerts/cases, collaborate with customers, and provide real-time visibility. |
| 4 | --- |
| 5 | |
| 6 | CoPilot’s **Customer Portal** is an **optional module** designed to bridge the gap between your internal SOC team (the CoPilot “admin” UI) and your external customers. |
| 7 | |
| 8 | It gives customers a clean, scoped interface to: |
| 9 | |
| 10 | - View **alerts** and **cases** that apply to *their* tenant |
| 11 | - Collaborate via **comments** (two-way) |
| 12 | - Track **status** updates (open/closed) |
| 13 | - View **agents/endpoints** associated with their tenant |
| 14 | - Share/receive **case files** (uploads) |
| 15 | |
| 16 | > Security note: treat the Customer Portal as an Internet-facing app **only** when it’s deployed behind a WAF / reverse proxy (and ideally a VPN). If you find security issues, please open a GitHub issue so we can address them. |
| 17 | |
| 18 | --- |
| 19 | |
| 20 | ## Architecture (high level) |
| 21 | |
| 22 | - **CoPilot Admin UI**: for internal SOC/admin work (full platform visibility) |
| 23 | - **Customer Portal UI**: separate container/service with limited customer-facing functionality |
| 24 | |
| 25 | In Docker Compose, the Customer Portal runs as a **separate service** (separate container) and is typically bound to its own port (commonly `8443`). |
| 26 | |
| 27 | --- |
| 28 | |
| 29 | ## Enable the Customer Portal (Docker Compose) |
| 30 | |
| 31 | 1) Edit your `docker-compose.yml` and uncomment/add the `copilot-customer-portal` service. |
| 32 | |
| 33 | Example: |
| 34 | |
| 35 | ```yaml |
| 36 | copilot-customer-portal: |
| 37 | image: ghcr.io/socfortress/copilot-customer-portal:latest |
| 38 | environment: |
| 39 | - SERVER_HOST=${SERVER_HOST:-localhost} |
| 40 | ports: |
| 41 | - "8443:443" |
| 42 | restart: always |
| 43 | ``` |
| 44 | |
| 45 | 2) Pull + start: |
| 46 | |
| 47 | ```bash |
| 48 | docker compose pull |
| 49 | docker compose up -d |
| 50 | ``` |
| 51 | |
| 52 | 3) Access: |
| 53 | |
| 54 | - `https://<your_instance_ip_or_hostname>:8443` |
| 55 | |
| 56 | > Recommendation: expose **only** the Customer Portal externally (not the admin UI), and front it with a WAF/reverse proxy. |
| 57 | |
| 58 | --- |
| 59 | |
| 60 | ## Customize branding (title + logo) |
| 61 | |
| 62 | In the **CoPilot Admin UI**, there is a **Customer Portal** section where you can: |
| 63 | |
| 64 | - Set the portal **title** |
| 65 | - Upload/update the portal **logo** |
| 66 | |
| 67 | These changes are reflected in the customer-facing portal. |
| 68 | |
| 69 | --- |
| 70 | |
| 71 | ## Create Customer Portal users |
| 72 | |
| 73 | Customer users are created in the **CoPilot Admin UI**: |
| 74 | |
| 75 | 1. Go to **Users** |
| 76 | 2. **Create user** |
| 77 | 3. Select role: `customer_user` |
| 78 | 4. Set an initial password (user can change after first login) |
| 79 | |
| 80 | ### Assign a user to a customer (tenant) |
| 81 | |
| 82 | After creating the user, **assign them to one or more customers**. Their portal view will only show alerts/cases/agents for the customer(s) they’re assigned. |
| 83 | |
| 84 | --- |
| 85 | |
| 86 | ## Collaboration model (alerts + cases) |
| 87 | |
| 88 | ### Comments (two-way) |
| 89 | |
| 90 | - SOC analysts can comment on an alert/case in the admin UI |
| 91 | - Customers can reply from the Customer Portal |
| 92 | - Both sides see the same comment thread |
| 93 | |
| 94 | ### Status updates |
| 95 | |
| 96 | Customers can update alert status (for example, closing an alert after validating remediation). The SOC side will see that status change. |
| 97 | |
| 98 | ### Case files |
| 99 | |
| 100 | Cases support file uploads, enabling you to share deliverables/evidence with the customer (and vice versa). |
| 101 | |
| 102 | --- |
| 103 | |
| 104 | ## Video walkthrough |
| 105 | |
| 106 | This page is based on the Customer Portal walkthrough video: |
| 107 | |
| 108 | - https://youtu.be/_bvFejcFwFM |