| 1 | CoPilot integrates with multiple upstream tools (SIEM, EDR, SOAR, DFIR, dashboards). In practice, “supported” means: |
| 2 | |
| 3 | - CoPilot’s connectors/provisioning logic has been **tested** against these versions |
| 4 | - API endpoints and payloads CoPilot relies on are stable in these versions |
| 5 | |
| 6 | If you’re running something older/newer, it *may* work — but this table is the **known-good** baseline. |
| 7 | |
| 8 | > If you hit a version-specific issue, open a GitHub issue with: |
| 9 | > CoPilot version, tool version, and the exact failing endpoint/UI path. |
| 10 | |
| 11 | --- |
| 12 | |
| 13 | ## Version compatibility matrix |
| 14 | |
| 15 | | Tool | Known-good / tested versions | Notes | |
| 16 | |---|---:|---| |
| 17 | | **Graylog** | **6.x** | CoPilot relies on Graylog Event Definitions writing to `gl-events_*` and uses fields that differ in older Graylog versions (ex: config differences around `event_limit`). | |
| 18 | | **Wazuh (Manager/Indexer)** | **4.14.2** | CoPilot’s vulnerability flows use Wazuh APIs that changed in newer Wazuh versions; 4.8+ is required for the “new” vulnerability API logic. | |
| 19 | | **Grafana** | **12.3.3** | CoPilot provisions/uses orgs, dashboards, and datasources via Grafana’s HTTP API; Grafana 9+ is the baseline for current provisioning workflows. | |
| 20 | | **Shuffle** | **(current)** | CoPilot invokes Shuffle workflows via API key + workflow ID. Recommended: run the latest stable Shuffle (cloud UI + on-prem worker/location). | |
| 21 | | **Velociraptor** | **0.75.6 (current)** | CoPilot integrates with Velociraptor via its API for hunting/collection workflows. Recommended: stay on the latest stable 0.7.x branch. | |
| 22 | |
| 23 | --- |
| 24 | |
| 25 | ## Where to check versions |
| 26 | |
| 27 | - **CoPilot version:** bottom-left of the CoPilot UI (or the Git tag/release you deployed) |
| 28 | - **Graylog version:** Graylog **System → Overview** |
| 29 | - **Wazuh version:** Wazuh dashboard footer / Wazuh API `/version` |
| 30 | - **Grafana version:** bottom-left footer |
| 31 | - **Shuffle version:** Shuffle admin/about (or image tag if self-hosted) |
| 32 | - **Velociraptor version:** server UI footer / `velociraptor --version` |