| 1 | # User Guide Overview |
| 2 | |
| 3 | CoPilot is a “single pane of glass” for operating an open-source SOC/SIEM stack. |
| 4 | |
| 5 |  |
| 6 | |
| 7 | ## Two primary user roles |
| 8 | |
| 9 | ### SOC operator / analyst |
| 10 | - Works primarily in **Incident Management** (alerts, cases, triage, tagging, comments, artifacts, reporting). |
| 11 | - Consumes events and detections coming from the SIEM data store. |
| 12 | |
| 13 | ### Admin / engineer |
| 14 | - Configures the systems that produce alerts and the data sources behind them (connectors, integrations, network connectors, scheduler jobs, etc.). |
| 15 | - Responsible for keeping the stack healthy and ensuring the right data is being ingested. |
| 16 | |
| 17 | ## Mental model |
| 18 | |
| 19 | - **Wazuh Indexer (OpenSearch-backed)** is the primary **event datastore** for SIEM events (endpoints, O365 integrations, network connectors, and other sources). |
| 20 | - **Graylog** commonly produces alerts into the `gl-events*` index pattern, which can then be queried and displayed through CoPilot’s Wazuh Indexer integration. |
| 21 | - CoPilot frequently resolves SIEM documents using **`index_name` + `index_id`**. |