| 1 | # SOCFortress CoPilot Documentation |
| 2 | |
| 3 | <div class="sf-hero" markdown> |
| 4 | |
| 5 | <div class="sf-hero-left" markdown> |
| 6 | |
| 7 | ## Operate your open‑source SOC |
| 8 | |
| 9 | CoPilot is a **single pane of glass** for operating an open‑source SOC/SIEM stack (Wazuh, Graylog, Velociraptor, Grafana, Shuffle, and more). |
| 10 | |
| 11 | <div class="sf-cta-row" markdown> |
| 12 | |
| 13 | [Operator quickstart](user/operators-quickstart.md) |
| 14 | [Admin/Engineer quickstart](user/admins-quickstart.md) |
| 15 | [UI Reference (menu)](user/ui/overview.md) |
| 16 | [Developer docs](developer/start-here.md) |
| 17 | |
| 18 | </div> |
| 19 | |
| 20 | <div class="sf-hero-meta" markdown> |
| 21 | |
| 22 | **Popular next steps:** [Customer provisioning](user/customer-provisioning.md) · [Videos (summarized)](user/videos.md) · [GitHub releases](https://github.com/socfortress/CoPilot/releases) |
| 23 | |
| 24 | </div> |
| 25 | |
| 26 | </div> |
| 27 | |
| 28 | <div class="sf-hero-right" markdown> |
| 29 | |
| 30 | <video class="sf-hero-video" autoPlay loop muted playsInline preload="auto"> |
| 31 | <source src="/assets/hero/copilot-hub.webm" type="video/webm" /> |
| 32 | <source src="/assets/hero/copilot-hub.mp4" type="video/mp4" /> |
| 33 | </video> |
| 34 | |
| 35 | </div> |
| 36 | |
| 37 | </div> |
| 38 | |
| 39 | --- |
| 40 | |
| 41 | ## Choose your path |
| 42 | |
| 43 | <div class="sf-home-grid" markdown> |
| 44 | |
| 45 | <div class="sf-card" markdown> |
| 46 | |
| 47 | ### SOC operator / analyst |
| 48 | |
| 49 | You live in **Incident Management** (alerts → cases → investigations). |
| 50 | |
| 51 | - [Operator quickstart](user/operators-quickstart.md) |
| 52 | - [Incident Management UI guide](user/ui/incident-management.md) |
| 53 | - [Videos track (Operator)](user/videos.md#operator-track) |
| 54 | |
| 55 | </div> |
| 56 | |
| 57 | <div class="sf-card" markdown> |
| 58 | |
| 59 | ### Admin / engineer |
| 60 | |
| 61 | You configure **sources, connectors, and integrations** so alerts flow into CoPilot. |
| 62 | |
| 63 | - [Admin/Engineer quickstart](user/admins-quickstart.md) |
| 64 | - [External services + integrations](user/ui/external-services.md) |
| 65 | - [Videos track (Admin/Engineer)](user/videos.md#adminengineer-track) |
| 66 | |
| 67 | </div> |
| 68 | |
| 69 | <div class="sf-card" markdown> |
| 70 | |
| 71 | ### Developer / AI Agent |
| 72 | |
| 73 | You’re changing the codebase, adding connectors, or debugging flows. |
| 74 | |
| 75 | - [Start here](developer/start-here.md) |
| 76 | - [Architecture](architecture/ARCHITECTURE.md) |
| 77 | - [Data flows](architecture/DATA_FLOWS.md) |
| 78 | - [Database schema](architecture/DATABASE_SCHEMA.md) |
| 79 | |
| 80 | </div> |
| 81 | |
| 82 | <div class="sf-card" markdown> |
| 83 | |
| 84 | ### Video library (summarized) |
| 85 | |
| 86 | Treat the YouTube playlist like documentation: links + structured bullets (no transcripts stored). |
| 87 | |
| 88 | - [Browse videos](user/videos.md) |
| 89 | - [Role-based tracks](user/videos.md#jump-to-your-role) |
| 90 | |
| 91 | </div> |
| 92 | |
| 93 | </div> |
| 94 | |
| 95 | --- |
| 96 | |
| 97 | ## Popular tasks |
| 98 | |
| 99 | <div class="sf-task-grid" markdown> |
| 100 | |
| 101 | <div class="sf-task-card" markdown> |
| 102 | |
| 103 | <h3 class="sf-task-title">Provision a customer</h3> |
| 104 | |
| 105 | Create a tenant + set up the minimum required configuration. |
| 106 | |
| 107 | [Customer provisioning →](user/customer-provisioning.md) |
| 108 | |
| 109 | </div> |
| 110 | |
| 111 | <div class="sf-task-card" markdown> |
| 112 | |
| 113 | <h3 class="sf-task-title">Add integrations & connectors</h3> |
| 114 | |
| 115 | Connect third‑party sources and external network connectors so data flows into CoPilot. |
| 116 | |
| 117 | [Integrations overview →](user/ui/external-third-party-integrations.md) |
| 118 | |
| 119 | </div> |
| 120 | |
| 121 | <div class="sf-task-card" markdown> |
| 122 | |
| 123 | <h3 class="sf-task-title">Triage an alert → open a case</h3> |
| 124 | |
| 125 | Start from an alert, pivot to evidence, and manage work in a case. |
| 126 | |
| 127 | [Incident alerts →](user/ui/incident-alerts.md) |
| 128 | |
| 129 | </div> |
| 130 | |
| 131 | <div class="sf-task-card" markdown> |
| 132 | |
| 133 | <h3 class="sf-task-title">Manage indices</h3> |
| 134 | |
| 135 | Find, validate, and troubleshoot index patterns and retention. |
| 136 | |
| 137 | [Indices management →](user/ui/indices-management.md) |
| 138 | |
| 139 | </div> |
| 140 | |
| 141 | <div class="sf-task-card" markdown> |
| 142 | |
| 143 | <h3 class="sf-task-title">Navigate the UI fast</h3> |
| 144 | |
| 145 | Map the sidebar/menu to routes and learn deep‑link patterns. |
| 146 | |
| 147 | [UI navigation guide →](user/navigation.md) |
| 148 | |
| 149 | </div> |
| 150 | |
| 151 | <div class="sf-task-card" markdown> |
| 152 | |
| 153 | <h3 class="sf-task-title">Build / change CoPilot safely</h3> |
| 154 | |
| 155 | Architecture, schema source‑of‑truth, and change playbooks. |
| 156 | |
| 157 | [Developer start here →](developer/start-here.md) |
| 158 | |
| 159 | </div> |
| 160 | |
| 161 | </div> |
| 162 | |
| 163 | --- |
| 164 | |
| 165 | ## How to use this site |
| 166 | |
| 167 | - Use the **left sidebar** (hamburger menu on mobile) to browse by area. |
| 168 | - Use **Search** (top bar) to jump straight to a topic. |
| 169 | - Everything lives under `docs/` and is updated via PRs (GitHub Pages build via Actions). |