@cryptotaxi247 / CoPilot
Code Commits Issues Pulls Sessions CI/CD
main
main
md 131 lines 4.15 KB
Rendered Raw
1 ---
2 title: Incident sources (Graylog → Alerts)
3 description: Configure how CoPilot reads Graylog event alerts and turns them into Incident Management alerts.
4 ---
5
6 # Incident sources (Graylog → Alerts)
7
8 **Menu:** Incident Management → Sources
9
10 **Best for:** Admin / Engineer
11
12 Incident Sources define how CoPilot **turns Graylog event alerts into CoPilot Incident Alerts**.
13
14 In practice, Sources answer:
15 - *Which logs/index patterns are eligible to create alerts?*
16 - *How do we group alerts by “source” (Wazuh vs O365 vs Mimecast vs …)?*
17 - *Which fields become the alert title, asset, timestamp, and context we see in CoPilot?*
18
19 ![Incident Sources](../../assets/ui/incident-sources.png)
20
21 ---
22
23 ## How alerting works (mental model)
24
25 CoPilot uses **Graylog** to do the detection logic and searching.
26
27 High level:
28
29 1) Graylog evaluates **Event Definitions** (your detection logic)
30 2) When an event fires, Graylog writes an alert into an index (commonly `gl-events*`)
31 3) CoPilot reads those event alerts and **creates/updates** alerts inside **Incident Management → Alerts**
32
33 ![Graylog event definition → gl-events* (placeholder)](../../assets/ui/incident-sources-graylog-event-def.png)
34
35 ---
36
37 ## What a “Source” means in CoPilot
38
39 A **Source** is essentially an **alert category**.
40
41 Examples:
42 - **Wazuh** (endpoint alerts)
43 - **Office 365**
44 - **Mimecast**
45 - **CrowdStrike**
46 - **Firewall / Syslog**
47
48 This keeps your triage queue clean and helps you group alerts by where they came from.
49
50 ---
51
52 ## Step 1 — Create a source
53
54 ![Sources list (placeholder)](../../assets/ui/incident-sources-list.png)
55
56 1) Open **Incident Management → Sources**
57 2) Click to **add** a new source
58 3) Give it a name you’ll use consistently (example: `wazuh`, `office365`, `mimecast`)
59
60 ---
61
62 ## Step 2 — Choose the index pattern(s) for this source
63
64 ![Create source (placeholder)](../../assets/ui/incident-sources-create-source.png)
65
66 You’ll select which index patterns/log sources are relevant for this alert source.
67
68 Important:
69 - This does **not** mean “alerts can only be created from this one index.”
70 - It’s defining what data CoPilot can use as **alert context** when it builds the alert record.
71
72 ---
73
74 ## Step 3 — Map the fields CoPilot needs (the important part)
75
76 ![Field mapping (placeholder)](../../assets/ui/incident-sources-field-mapping.png)
77
78 A source defines which fields CoPilot should use when it creates an alert.
79
80 ### Alert title field
81 This becomes the alert’s **title** in CoPilot.
82
83 Example (Wazuh):
84 - rule description is often the best title field (it explains *why* it fired).
85
86 ### Asset name field
87 This controls which entity becomes the **Asset** on the alert (and is key for dedup/merging behavior).
88
89 Example (Wazuh):
90 - agent name is commonly used as the asset name.
91
92 ### Time field
93 This controls which timestamp CoPilot uses for alert ordering/timelines.
94
95 Tip:
96 - Pick the most reliable timestamp for the detection record you’re using.
97
98 ### Context fields
99 These are the fields you want visible inside the alert details.
100
101 Important distinction:
102 - Context fields are **not** the detection logic.
103 - Detection logic stays in **Graylog Event Definitions**.
104 - Context fields define what metadata CoPilot stores/displays when the alert fires.
105
106 ---
107
108 ## Step 4 — Validate end-to-end
109
110 1) In Graylog, confirm your **Event Definition** is firing (test with a known event)
111 2) Confirm Graylog writes events into `gl-events*`
112 3) In CoPilot, confirm a new alert appears under **Incident Management → Alerts** with:
113 - correct **Source**
114 - correct **Title**
115 - correct **Asset**
116 - useful **Context** fields
117
118 ---
119
120 ## Common gotchas
121
122 ### “Graylog is alerting, but CoPilot shows nothing”
123 Usually one of:
124 - the event alerts aren’t being written where CoPilot expects (index / permissions)
125 - source field mappings don’t match the fields in the event payload
126
127 ### “Alerts are grouped wrong / mixed between integrations”
128 Create separate Sources (Wazuh vs O365 vs Mimecast vs firewall) and ensure your Graylog event definitions populate the fields needed to classify them.
129
130 ### “Alerts don’t have enough metadata”
131 Add more **context fields** to the source mapping so CoPilot can store/display the details operators need.