| 1 | --- |
| 2 | title: SOCFortress CoPilot |
| 3 | description: Operate an open-source SOC/SIEM stack from a single pane of glass. |
| 4 | --- |
| 5 | |
| 6 | # SOCFortress CoPilot Documentation |
| 7 | |
| 8 | CoPilot is a **single pane of glass** for operating an open‑source SOC/SIEM stack (Wazuh, Graylog, Velociraptor, Grafana, Shuffle, and more). |
| 9 | |
| 10 | **Choose your path:** |
| 11 | |
| 12 | <Card title="Start here" icon="map" href="/getting-started/start-here" horizontal> |
| 13 | Guided path: ingest → dashboards → alerts → cases → response. |
| 14 | </Card> |
| 15 | |
| 16 | <Card title="SOC Operator / Analyst" icon="siren" href="/user/operators-quickstart" horizontal> |
| 17 | Alert triage → cases → investigations. |
| 18 | </Card> |
| 19 | |
| 20 | <Card title="Admin / Engineer" icon="gear" href="/user/admins-quickstart" horizontal> |
| 21 | Configure sources, connectors, and integrations. |
| 22 | </Card> |
| 23 | |
| 24 | <Card title="Developer / AI Agent" icon="code" href="/developer/start-here" horizontal> |
| 25 | Architecture, data flows, schema, and safe change playbooks. |
| 26 | </Card> |
| 27 | |
| 28 | <Frame> |
| 29 | <div style={{ width: '100%', maxWidth: 1100, margin: '0 auto' }}> |
| 30 | <video |
| 31 | autoPlay |
| 32 | loop |
| 33 | muted |
| 34 | playsInline |
| 35 | preload="auto" |
| 36 | controls={false} |
| 37 | disablePictureInPicture |
| 38 | onClick={(e) => e.currentTarget.play()} |
| 39 | style={{ |
| 40 | width: '100%', |
| 41 | aspectRatio: '16 / 9', |
| 42 | height: 'auto', |
| 43 | display: 'block', |
| 44 | borderRadius: 16, |
| 45 | background: 'rgba(0,0,0,0.2)', |
| 46 | }} |
| 47 | > |
| 48 | <source src="/assets/hero/copilot-hub.webm" type="video/webm" /> |
| 49 | <source src="/assets/hero/copilot-hub.mp4" type="video/mp4" /> |
| 50 | </video> |
| 51 | </div> |
| 52 | </Frame> |
| 53 | |
| 54 | <div style={{ fontSize: 13, opacity: 0.8, marginTop: 8 }}> |
| 55 | If the animation doesn’t autoplay in your browser, click once to start playback. |
| 56 | </div> |
| 57 | |
| 58 | ## Popular tasks |
| 59 | |
| 60 | <Columns cols={3}> |
| 61 | <Card title="Provision a customer" icon="users" href="/user/customer-provisioning"> |
| 62 | Create a tenant and set up the minimum required configuration. |
| 63 | </Card> |
| 64 | <Card title="Add integrations & connectors" icon="plug" href="/user/ui/external-third-party-integrations"> |
| 65 | Connect third‑party sources and external network connectors. |
| 66 | </Card> |
| 67 | <Card title="Triage an alert → open a case" icon="triangle-exclamation" href="/user/ui/incident-alerts"> |
| 68 | Start from an alert and manage work in a case. |
| 69 | </Card> |
| 70 | </Columns> |
| 71 | |
| 72 | <Columns cols={3}> |
| 73 | <Card title="Manage indices" icon="database" href="/user/ui/indices-management"> |
| 74 | Validate index patterns, retention, and troubleshooting. |
| 75 | </Card> |
| 76 | <Card title="Browse the UI Guide" icon="map" href="/user/ui/overview"> |
| 77 | Documentation that mirrors the CoPilot menu. |
| 78 | </Card> |
| 79 | <Card title="Video library (summarized)" icon="play" href="/user/videos"> |
| 80 | Watch the playlist like docs: links + structured bullets (no transcripts stored). |
| 81 | </Card> |
| 82 | </Columns> |
| 83 | |
| 84 | ## Get oriented |
| 85 | |
| 86 | <Steps> |
| 87 | <Step title="Start with a quickstart"> |
| 88 | Operators: start with the [Operator quickstart](/user/operators-quickstart). Admins/engineers: start with the [Admin/Engineer quickstart](/user/admins-quickstart). |
| 89 | </Step> |
| 90 | <Step title="Use the UI Guide for day-to-day workflows"> |
| 91 | The [UI Guide](/user/ui/overview) mirrors the menu so people can find what they see in the product. |
| 92 | </Step> |
| 93 | <Step title="Use videos as supplemental walkthroughs"> |
| 94 | The [Videos page](/user/videos) summarizes the full playlist into skimmable sections. |
| 95 | </Step> |
| 96 | </Steps> |