| 1 | --- |
| 2 | title: What is CoPilot? |
| 3 | description: CoPilot is a single pane of glass for operating and integrating an open-source SOC/SIEM stack. |
| 4 | --- |
| 5 | |
| 6 | SOCFortress CoPilot is a **single pane of glass** for operating an open‑source SOC/SIEM stack. |
| 7 | |
| 8 | It sits above tools like **Wazuh**, **Graylog**, **Velociraptor**, **Grafana**, and **Shuffle** and helps you: |
| 9 | |
| 10 | - **Operate incidents**: alerts → cases → evidence → response |
| 11 | - **Onboard data**: customer/tenant provisioning, integrations, and connectors |
| 12 | - **Reduce context switching** with a consistent UI and workflow |
| 13 | |
| 14 | <Frame> |
| 15 | <div style={{ width: '100%', maxWidth: 1100, margin: '0 auto' }}> |
| 16 | <video |
| 17 | autoPlay |
| 18 | loop |
| 19 | muted |
| 20 | playsInline |
| 21 | preload="auto" |
| 22 | controls={false} |
| 23 | disablePictureInPicture |
| 24 | onClick={(e) => e.currentTarget.play()} |
| 25 | style={{ |
| 26 | width: '100%', |
| 27 | aspectRatio: '16 / 9', |
| 28 | height: 'auto', |
| 29 | display: 'block', |
| 30 | borderRadius: 16, |
| 31 | background: 'rgba(0,0,0,0.2)', |
| 32 | }} |
| 33 | > |
| 34 | <source src="/assets/hero/copilot-hub.webm" type="video/webm" /> |
| 35 | <source src="/assets/hero/copilot-hub.mp4" type="video/mp4" /> |
| 36 | </video> |
| 37 | </div> |
| 38 | </Frame> |
| 39 | |
| 40 | <div style={{ fontSize: 13, opacity: 0.8, marginTop: 8 }}> |
| 41 | If the animation doesn’t autoplay in your browser, click once to start playback. |
| 42 | </div> |
| 43 | |
| 44 | ## Who is it for? |
| 45 | |
| 46 | <Columns cols={3}> |
| 47 | <Card title="SOC operators / analysts" icon="siren"> |
| 48 | Daily triage and case work. |
| 49 | </Card> |
| 50 | <Card title="Admins / engineers" icon="gear"> |
| 51 | Data onboarding, integrations, indices, and reliability. |
| 52 | </Card> |
| 53 | <Card title="Developers" icon="code"> |
| 54 | Extend CoPilot safely (connectors, schema changes, data flows). |
| 55 | </Card> |
| 56 | </Columns> |
| 57 | |
| 58 | ## The mental model |
| 59 | |
| 60 | Think of CoPilot as two loops: |
| 61 | |
| 62 | 1. **Incident loop** (operator): detect → triage → investigate → contain |
| 63 | 2. **Ingestion loop** (admin): connect → route → normalize → validate |
| 64 | |
| 65 | Next: read [Roles & mental model](/getting-started/roles-and-mental-model) and then pick a quickstart. |