main
mdx 140 lines 3.92 KB
Raw
1 ---
2 title: Roles & mental model
3 description: How to think about CoPilot as a SOC operator vs. admin/engineer vs. developer.
4 ---
5
6 CoPilot is easiest to learn if you separate it into **two jobs**:
7
8 1) **Operate incidents** (alerts → cases → evidence → response)
9 2) **Make incidents possible** (connect sources/integrations so alerts flow)
10
11 ---
12
13 ## The mental model (visual)
14
15 CoPilot becomes intuitive when you see it as **two loops** that share the same data:
16
17 <Columns cols={2}>
18 <Card title="Admin / Platform loop" icon="gear">
19 You make detection possible.
20
21 <Steps>
22 <Step title="Connect & verify">
23 Integrations + syslog connectors are healthy.
24 </Step>
25 <Step title="Ingest & route">
26 Streams/pipelines route logs where they should go.
27 </Step>
28 <Step title="Provision & visualize">
29 Customers/tenants, dashboards, indices, retention.
30 </Step>
31 <Step title="Enable alerting">
32 Event definitions + notifications are configured.
33 </Step>
34 <Step title="Tune & maintain">
35 Reduce noise, validate coverage, keep things reliable.
36 </Step>
37 </Steps>
38 </Card>
39
40 <Card title="Operator loop" icon="siren">
41 You run incidents.
42
43 <Steps>
44 <Step title="Alert appears">
45 New alert lands in Incident Management.
46 </Step>
47 <Step title="Triage">
48 Decide: true positive? priority? scope?
49 </Step>
50 <Step title="Case work">
51 Create a case, collect artifacts/evidence.
52 </Step>
53 <Step title="Respond">
54 Contain, eradicate, recover.
55 </Step>
56 <Step title="Feedback">
57 Feed improvements back into tuning/detections.
58 </Step>
59 </Steps>
60 </Card>
61 </Columns>
62
63 ### How alerts become cases (the shared pipeline)
64
65 <Steps>
66 <Step title="1) Data arrives">
67 Endpoints (Wazuh), API integrations (O365/Mimecast/Huntress/CrowdStrike), and syslog devices (FortiGate/PAN‑OS/ASA).
68 </Step>
69 <Step title="2) Normalize & route">
70 Graylog streams/pipelines normalize fields and route logs.
71 </Step>
72 <Step title="3) Detect">
73 Graylog Event Definitions evaluate conditions and generate events.
74 </Step>
75 <Step title="4) Persist">
76 Alerts are written to `gl-events*`.
77 </Step>
78 <Step title="5) Operate">
79 CoPilot surfaces alerts → operators create/work cases → response.
80 </Step>
81 </Steps>
82
83 ### “Where do I click?” (quick map)
84
85 <Columns cols={3}>
86 <Card title="Operators" icon="siren" href="/user/operators-quickstart">
87 Incident Management → Alerts → Cases
88 </Card>
89 <Card title="Admins / engineers" icon="gear" href="/user/admins-quickstart">
90 Provisioning → Integrations → Connectors → Indices
91 </Card>
92 <Card title="Developers" icon="code" href="/developer/start-here">
93 Architecture → Data flows → Connectors
94 </Card>
95 </Columns>
96
97 ---
98
99 ## SOC operator / analyst
100
101 You spend most of your time in **Incident Management**.
102
103 You care about:
104 - Is this alert real?
105 - What’s the blast radius?
106 - What evidence do I need?
107 - What do I do next?
108
109 **Start here:**
110 - [Operator quickstart](/user/operators-quickstart)
111 - [Incident alerts (UI reference)](/user/ui/incident-alerts)
112 - [Cases (UI reference)](/user/ui/incident-cases)
113 - Videos: [Operator track](/user/videos#operator-track)
114
115 ## Admin / engineer
116
117 You care about **data onboarding and reliability**.
118
119 You care about:
120 - Are sources connected and healthy?
121 - Are parsing / streams / pipelines configured correctly?
122 - Are indices and retention behaving?
123 - Is each customer/tenant provisioned correctly?
124
125 **Start here:**
126 - [Admin/Engineer quickstart](/user/admins-quickstart)
127 - [Customer provisioning](/user/customer-provisioning)
128 - Videos: [Admin/Engineer track](/user/videos#adminengineer-track)
129
130 ## Developer / AI agent
131
132 You are extending or modifying CoPilot.
133
134 You care about:
135 - Architecture + data flows
136 - Schema changes (Alembic as source of truth)
137 - Adding a connector safely
138
139 **Start here:**
140 - [Developer start here](/developer/start-here)