| 1 | # Navigation Guide (UI Map + Tips) |
| 2 | |
| 3 | This page explains what each left‑hand navigation item in CoPilot does and how to use the UI efficiently. |
| 4 | |
| 5 | > Source of truth: `frontend/src/app-layouts/common/Navbar/items.tsx` (nav items) and `frontend/src/router/index.ts` (routes). |
| 6 | |
| 7 | --- |
| 8 | |
| 9 | ## Quick tips (applies to everyone) |
| 10 | |
| 11 | - **Use the left nav as your workflow map**: |
| 12 | - *AI Analyst* = AI-powered investigation and chat |
| 13 | - *Customers* = select your customer context first |
| 14 | - *SIEM + Incident Management* = where analysts detect and respond |
| 15 | - *Agents* = endpoint management and detection rules |
| 16 | - *Log Management* = indices, snapshots, and Graylog pipeline health |
| 17 | - *Tools* = connectors, assessments, and utilities |
| 18 | |
| 19 | - **Deep links exist** (helpful for bookmarking / SOPs): |
| 20 | - Incident Alerts can be opened directly via `?alert_id=<id>` |
| 21 | - Incident Cases can be opened directly via `?case_id=<id>` |
| 22 | - Customers supports `?code=<customer_code>` and `?action=add-customer` |
| 23 | - Graylog Management supports tab anchors like `#streams`, `#inputs`, etc. |
| 24 | |
| 25 | --- |
| 26 | |
| 27 | ## "Where do I start?" by role |
| 28 | |
| 29 | ### SOC operator / analyst |
| 30 | |
| 31 | 1. **AI Analyst** (`/ai-analyst`) – AI-powered investigation, reports, and Talon chat |
| 32 | 2. **Incident Management → Alerts** (`/incident-management/alerts`) |
| 33 | 3. **Incident Management → Cases** (`/incident-management/cases`) |
| 34 | |
| 35 | ### Admin / engineer |
| 36 | |
| 37 | 1. **Tools → Connectors** (`/connectors`) – connect the underlying systems (Wazuh, Graylog, Grafana, Velociraptor, etc.) |
| 38 | 2. **Log Management → Index Management** (`/indices/management`) – index health/visibility and troubleshooting |
| 39 | 3. **Log Management → Graylog Management** (`/graylog/management`) – alert plumbing / streams / inputs / provisioning |
| 40 | |
| 41 | --- |
| 42 | |
| 43 | ## Left navigation map (what each item does) |
| 44 | |
| 45 | Below are screenshots of the main areas (from a lab environment) to help you quickly recognize where you are in the UI. |
| 46 | |
| 47 | - Overview: |
| 48 | |
| 49 |  |
| 50 | |
| 51 | - Incident Management → Alerts: |
| 52 | |
| 53 |  |
| 54 | |
| 55 | - Connectors: |
| 56 | |
| 57 |  |
| 58 | |
| 59 | - Log Management → Index Management: |
| 60 | |
| 61 |  |
| 62 | |
| 63 | - Log Management → Graylog Management: |
| 64 | |
| 65 |  |
| 66 | |
| 67 | --- |
| 68 | |
| 69 | ### Overview |
| 70 | |
| 71 | - **Overview** → `/overview` |
| 72 | - High-level dashboard/landing page once logged in. |
| 73 | |
| 74 | ### AI Analyst |
| 75 | |
| 76 | - **AI Analyst** → `/ai-analyst` |
| 77 | - AI-powered investigation hub with Talon chat, alert reports, and architecture overview. |
| 78 | |
| 79 | ### Customers |
| 80 | |
| 81 | - **Customers** → `/customers` |
| 82 | - Multi-tenant/customer context management. |
| 83 | - Deep links: |
| 84 | - `/customers?code=<customer_code>` |
| 85 | - `/customers?action=add-customer` |
| 86 | |
| 87 | ### SIEM (detection/testing oriented) |
| 88 | |
| 89 | - **SIEM → Alerts** → `/alerts/siem` |
| 90 | - SIEM-centric alert view (Graylog-backed in current routing). |
| 91 | |
| 92 | - **SIEM → Event Search** → `/alerts/event-search` |
| 93 | - Search and filter raw events. |
| 94 | |
| 95 | - **SIEM → Dashboards** → `/alerts/dashboards` |
| 96 | - SIEM dashboards. |
| 97 | |
| 98 | - **SIEM → MITRE ATT&CK** → `/alerts/mitre` |
| 99 | - ATT&CK mapping view. |
| 100 | |
| 101 | - **SIEM → Atomic Red Team** → `/alerts/atomic-red-team` |
| 102 | - Adversary simulation / test harness view. |
| 103 | |
| 104 | ### Incident Management (operator-first) |
| 105 | |
| 106 | - **Incident Management → Sources** → `/incident-management/sources` |
| 107 | - Defines/controls *where alerts come from* (your "alert sources" / categories). |
| 108 | |
| 109 | - **Incident Management → Alerts** → `/incident-management/alerts` |
| 110 | - Primary triage queue. |
| 111 | - Deep link: `/incident-management/alerts?alert_id=<id>` |
| 112 | |
| 113 | - **Incident Management → Cases** → `/incident-management/cases` |
| 114 | - Investigation lifecycle management. |
| 115 | - Deep link: `/incident-management/cases?case_id=<id>` |
| 116 | |
| 117 | ### Agents (endpoint-facing capabilities) |
| 118 | |
| 119 | - **Agents → Agents list** → `/agents` |
| 120 | - **Agents → Artifacts** → `/artifacts` |
| 121 | - Evidence, files, and investigation artifacts. |
| 122 | - **Agents → Groups** → `/agents/groups` |
| 123 | - **Agents → Sysmon Config** → `/agents/sysmon-config` |
| 124 | - **Agents → Detection Rules** → `/agents/detection-rules` |
| 125 | - **Agents → CoPilot Actions** → `/agents/copilot-actions` |
| 126 | - **Agents → CoPilot Searches** → `/agents/copilot-searches` |
| 127 | - **Agents → Vulnerability Overview** → `/agents/vulnerability-overview` |
| 128 | - **Agents → Patch Tuesday** → `/patch-tuesday` *(note: defined under Agents menu, but route is top-level)* |
| 129 | - **Agents → SCA Overview** → `/agents/sca-overview` |
| 130 | - **Agents → SCA Policies** → `/agents/sca-policies` |
| 131 | |
| 132 | ### Log Management (admin/ops) |
| 133 | |
| 134 | - **Log Management → Index Management** → `/indices/management` |
| 135 | - Deep link supports `?index_name=<name>`. |
| 136 | |
| 137 | - **Log Management → Snapshot & Restore** → `/indices/snapshots` |
| 138 | |
| 139 | - **Log Management → Graylog Management** → `/graylog/management` |
| 140 | - Supports hash navigation to tabs (example): |
| 141 | - `/graylog/management#streams` |
| 142 | - `/graylog/management#inputs` |
| 143 | - `/graylog/management#events` |
| 144 | |
| 145 | - **Log Management → Graylog Metrics** → `/graylog/metrics` |
| 146 | |
| 147 | - **Log Management → Graylog Pipelines** → `/graylog/pipelines` |
| 148 | - Supports `?rule=<something>` for jumping to a pipeline rule. |
| 149 | |
| 150 | ### Report Creation |
| 151 | |
| 152 | - **Report Creation → General Reports** → `/report-creation/general` |
| 153 | - **Report Creation → Vulnerability Reports** → `/report-creation/vulnerability-reports` |
| 154 | - **Report Creation → SCA Reports** → `/report-creation/sca-reports` |
| 155 | |
| 156 | ### Healthcheck |
| 157 | |
| 158 | - **Healthcheck → Healthcheck Alerts** → `/healthcheck` |
| 159 | - Health/status style overview (commonly used by admins/operators to confirm stack state). |
| 160 | - **Healthcheck → Metrics Overview** → `/healthcheck/metrics` |
| 161 | |
| 162 | ### Tools (admin/engineer) |
| 163 | |
| 164 | - **Tools → Connectors** → `/connectors` |
| 165 | - Configure and validate connections to underlying stack services. |
| 166 | - **Tools → Stack Provisioning** – stack provisioning workflows |
| 167 | - **Tools → Cloud Security Assessment** → `/tools/cloud-security-assessment` |
| 168 | - **Tools → Web Vulnerability Assessment** → `/tools/web-vulnerability-assessment` |
| 169 | - **Tools → GitHub Audit** → `/tools/github-audit` |
| 170 | - **Tools → Active Response** – active response actions |
| 171 | - **Tools → Threat Intel** – threat intelligence lookups |
| 172 | |
| 173 | --- |
| 174 | |
| 175 | ## User menu (avatar icon, top-right) |
| 176 | |
| 177 | The user avatar dropdown contains account, administration, and resource links: |
| 178 | |
| 179 | ### Account |
| 180 | - **Profile** → `/profile` |
| 181 | - **License** → `/license` |
| 182 | - **Users** → `/users` |
| 183 | - **SSO Config** → `/sso-config` *(admin only)* |
| 184 | |
| 185 | ### Administration |
| 186 | - **Scheduler** → `/scheduler` – job scheduling / automation |
| 187 | - **Customer Portal** → `/customer-portal` – customer-facing portal view |
| 188 | - **Logs** → `/logs` |
| 189 | |
| 190 | ### External Services |
| 191 | - **3rd Party Integrations** → `/external-services/third-party-integrations` |
| 192 | - **Network Connectors** → `/external-services/network-connectors` |
| 193 | - **Singul App Auth** → `/external-services/singul-app-auth` |
| 194 | |
| 195 | ### Resources |
| 196 | - **Documentation** → [docs.socfortress.co](https://docs.socfortress.co/) *(external)* |
| 197 | - **Contact SOCFortress** → [socfortress.co/contact-us](https://www.socfortress.co/contact-us) *(external)* |
| 198 | |
| 199 | --- |
| 200 | |
| 201 | ## Suggested mental model (helps teams onboard) |
| 202 | |
| 203 | - **Operators**: |
| 204 | - live in *AI Analyst*, *SIEM*, and *Incident Management* — select a *Customer* first, then triage. |
| 205 | |
| 206 | - **Admins/Engineers**: |
| 207 | - spend time in *Tools → Connectors*, *Log Management*, and the *User menu → External Services* to ensure the pipeline is healthy. |
| 208 | |
| 209 | - **Detection engineering / testing**: |
| 210 | - *SIEM (MITRE/Atomic Red Team)* + *Agents (Rules/Sysmon)* + *User menu → Scheduler*. |
| 211 | # Navigation Guide (UI Map + Tips) |
| 212 | |
| 213 | This page explains what each left‑hand navigation item in CoPilot does and how to use the UI efficiently. |
| 214 | |
| 215 | > Source of truth: `frontend/src/app-layouts/common/Navbar/items.tsx` (nav items) and `frontend/src/router/index.ts` (routes). |
| 216 | |
| 217 | --- |
| 218 | |
| 219 | ## Quick tips (applies to everyone) |
| 220 | |
| 221 | - **Use the left nav as your workflow map**: |
| 222 | - *Incident Management* = where analysts live (alerts/cases) |
| 223 | - *Connectors / External Services / Indices* = where engineers wire up data and keep the stack healthy |
| 224 | |
| 225 | - **Deep links exist** (helpful for bookmarking / SOPs): |
| 226 | - Incident Alerts can be opened directly via `?alert_id=<id>` |
| 227 | - Incident Cases can be opened directly via `?case_id=<id>` |
| 228 | - Customers supports `?code=<customer_code>` and `?action=add-customer` |
| 229 | - Graylog Management supports tab anchors like `#streams`, `#inputs`, etc. |
| 230 | |
| 231 | --- |
| 232 | |
| 233 | ## “Where do I start?” by role |
| 234 | |
| 235 | ### SOC operator / analyst |
| 236 | |
| 237 | 1. **Incident Management → Alerts** (`/incident-management/alerts`) |
| 238 | 2. **Incident Management → Cases** (`/incident-management/cases`) |
| 239 | 3. **Artifacts** (`/artifacts`) for evidence / files you need to attach or review |
| 240 | |
| 241 | ### Admin / engineer |
| 242 | |
| 243 | 1. **Connectors** (`/connectors`) – connect the underlying systems (Wazuh, Graylog, Grafana, Velociraptor, etc.) |
| 244 | 2. **External Services** (`/external-services/...`) – configure third‑party sources / network connectors |
| 245 | 3. **Indices → Index Management** (`/indices/management`) – index health/visibility and troubleshooting |
| 246 | 4. **Graylog → Management** (`/graylog/management`) – alert plumbing / streams / inputs / provisioning |
| 247 | |
| 248 | --- |
| 249 | |
| 250 | ## Left navigation map (what each item does) |
| 251 | |
| 252 | Below are screenshots of the main areas (from a lab environment) to help you quickly recognize where you are in the UI. |
| 253 | |
| 254 | - Overview: |
| 255 | |
| 256 |  |
| 257 | |
| 258 | - Incident Management → Alerts: |
| 259 | |
| 260 |  |
| 261 | |
| 262 | - Connectors: |
| 263 | |
| 264 |  |
| 265 | |
| 266 | - Indices → Index Management: |
| 267 | |
| 268 |  |
| 269 | |
| 270 | - Graylog → Management: |
| 271 | |
| 272 |  |
| 273 | |
| 274 | --- |
| 275 | |
| 276 | ### Overview |
| 277 | |
| 278 | - **Overview** → `/overview` |
| 279 | - High-level dashboard/landing page once logged in. |
| 280 | |
| 281 | ### Incident Management (operator-first) |
| 282 | |
| 283 | - **Incident Management → Sources** → `/incident-management/sources` |
| 284 | - Defines/controls *where alerts come from* (your “alert sources” / categories). |
| 285 | |
| 286 | - **Incident Management → Alerts** → `/incident-management/alerts` |
| 287 | - Primary triage queue. |
| 288 | - Deep link: `/incident-management/alerts?alert_id=<id>` |
| 289 | |
| 290 | - **Incident Management → Cases** → `/incident-management/cases` |
| 291 | - Investigation lifecycle management. |
| 292 | - Deep link: `/incident-management/cases?case_id=<id>` |
| 293 | |
| 294 | ### Alerts (engineering/testing oriented) |
| 295 | |
| 296 | - **Alerts → SIEM** → `/alerts/siem` |
| 297 | - SIEM-centric alert view (Graylog-backed in current routing). |
| 298 | |
| 299 | - **Alerts → MITRE ATT&CK** → `/alerts/mitre` |
| 300 | - ATT&CK mapping view. |
| 301 | |
| 302 | - **Alerts → Atomic Red Team** → `/alerts/atomic-red-team` |
| 303 | - Adversary simulation / test harness view. |
| 304 | |
| 305 | ### Artifacts |
| 306 | |
| 307 | - **Artifacts** → `/artifacts` |
| 308 | - Evidence, files, and investigation artifacts. |
| 309 | |
| 310 | ### Customers |
| 311 | |
| 312 | - **Customers** → `/customers` |
| 313 | - Multi-tenant/customer context management. |
| 314 | - Deep links: |
| 315 | - `/customers?code=<customer_code>` |
| 316 | - `/customers?action=add-customer` |
| 317 | |
| 318 | ### Agents (endpoint-facing capabilities) |
| 319 | |
| 320 | - **Agents → Agents list** → `/agents` |
| 321 | - **Agents → Groups** → `/agents/groups` |
| 322 | - **Agents → Sysmon Config** → `/agents/sysmon-config` |
| 323 | - **Agents → Detection Rules** → `/agents/detection-rules` |
| 324 | - **Agents → CoPilot Actions** → `/agents/copilot-actions` |
| 325 | - **Agents → Vulnerability Overview** → `/agents/vulnerability-overview` |
| 326 | - **Agents → Patch Tuesday** → `/patch-tuesday` *(note: defined under Agents menu, but route is top-level)* |
| 327 | - **Agents → SCA Overview** → `/agents/sca-overview` |
| 328 | |
| 329 | ### Report Creation |
| 330 | |
| 331 | - **Report Creation → General Reports** → `/report-creation/general` |
| 332 | - **Report Creation → Vulnerability Reports** → `/report-creation/vulnerability-reports` |
| 333 | - **Report Creation → SCA Reports** → `/report-creation/sca-reports` |
| 334 | |
| 335 | ### Healthcheck |
| 336 | |
| 337 | - **Healthcheck** → `/healthcheck` |
| 338 | - Health/status style overview (commonly used by admins/operators to confirm stack state). |
| 339 | |
| 340 | ### Indices (admin/ops) |
| 341 | |
| 342 | - **Indices → Index Management** → `/indices/management` |
| 343 | - Deep link supports `?index_name=<name>`. |
| 344 | |
| 345 | - **Indices → Snapshot & Restore** → `/indices/snapshots` |
| 346 | |
| 347 | ### Graylog (admin/ops) |
| 348 | |
| 349 | - **Graylog → Management** → `/graylog/management` |
| 350 | - Supports hash navigation to tabs (example): |
| 351 | - `/graylog/management#streams` |
| 352 | - `/graylog/management#inputs` |
| 353 | - `/graylog/management#events` |
| 354 | |
| 355 | - **Graylog → Metrics** → `/graylog/metrics` |
| 356 | |
| 357 | - **Graylog → Pipelines** → `/graylog/pipelines` |
| 358 | - Supports `?rule=<something>` for jumping to a pipeline rule. |
| 359 | |
| 360 | ### Connectors (admin/engineer) |
| 361 | |
| 362 | - **Connectors** → `/connectors` |
| 363 | - Configure and validate connections to underlying stack services. |
| 364 | |
| 365 | ### External Services (admin/engineer) |
| 366 | |
| 367 | - **External Services → 3rd Party Integrations** → `/external-services/third-party-integrations` |
| 368 | - **External Services → Network Connectors** → `/external-services/network-connectors` |
| 369 | - **External Services → Singul App Auth** → `/external-services/singul-app-auth` |
| 370 | |
| 371 | ### Scheduler |
| 372 | |
| 373 | - **Scheduler** → `/scheduler` |
| 374 | - Job scheduling / automation. |
| 375 | |
| 376 | ### Customer Portal |
| 377 | |
| 378 | - **Customer Portal** → `/customer-portal` |
| 379 | - Customer-facing portal view. |
| 380 | |
| 381 | --- |
| 382 | |
| 383 | ## Suggested mental model (helps teams onboard) |
| 384 | |
| 385 | - **Operators**: |
| 386 | - live in *Incident Management* and only dip into *Artifacts* and *Customers* as needed. |
| 387 | |
| 388 | - **Admins/Engineers**: |
| 389 | - spend time in *Connectors*, *External Services*, *Graylog*, and *Indices* to ensure the pipeline is healthy. |
| 390 | |
| 391 | - **Detection engineering / testing**: |
| 392 | - *Alerts (MITRE/Atomic Red Team)* + *Agents (Rules/Sysmon)* + *Scheduler*. |