| 1 | --- |
| 2 | title: Event Sources |
| 3 | description: Configure the SIEM event sources that define where Event Search queries data from for each customer. |
| 4 | --- |
| 5 | |
| 6 | # Event Sources |
| 7 | |
| 8 | **Menu:** Customers → (select customer) → Event Sources tab |
| 9 | |
| 10 | **Best for:** Admin / Engineer |
| 11 | |
| 12 | Event Sources tell CoPilot which **index patterns** to query for each customer when using [Event Search](/user/ui/siem-event-search). You must configure at least one Event Source per customer before Event Search will work for that customer. |
| 13 | |
| 14 | --- |
| 15 | |
| 16 | ## What is an Event Source? |
| 17 | |
| 18 | An Event Source defines: |
| 19 | |
| 20 | | Field | Description | |
| 21 | |---|---| |
| 22 | | **Name** | A human-readable label (e.g. "Wazuh EDR", "Office 365 Logs") | |
| 23 | | **Index Pattern** | The Wazuh Indexer index pattern to query (e.g. `wazuh-CUSTOMER_CODE_*`) | |
| 24 | | **Event Type** | Category — one of: EDR, EPP, Cloud Integration, Network Security | |
| 25 | | **Time Field** | The field used for time-based filtering (typically `timestamp`) | |
| 26 | | **Enabled** | Whether this source is available for selection in Event Search | |
| 27 | |
| 28 | --- |
| 29 | |
| 30 | ## Step 1 — Navigate to the customer's Event Sources |
| 31 | |
| 32 | 1. Go to **Customers** in the sidebar |
| 33 | 2. Select the customer you want to configure |
| 34 | 3. Click the **Event Sources** tab |
| 35 | |
| 36 | --- |
| 37 | |
| 38 | ## Step 2 — Create a new Event Source |
| 39 | |
| 40 | Click the **+ Add** button and fill in the form: |
| 41 | |
| 42 |  |
| 43 | |
| 44 | **Tips:** |
| 45 | - The **Index Pattern** field auto-suggests patterns based on the customer code (e.g. `wazuh-lab_*`) |
| 46 | - For Wazuh/EDR data, use `timestamp` as the Time Field |
| 47 | - Set **Event Type** to match the data type so analysts can filter sources by category |
| 48 | |
| 49 | --- |
| 50 | |
| 51 | ## Step 3 — Edit or delete an Event Source |
| 52 | |
| 53 | Each Event Source card shows its configuration at a glance. Use the action buttons to: |
| 54 | - **Edit** — update the index pattern, time field, or toggle enabled/disabled |
| 55 | - **Delete** — permanently remove the source (admin only) |
| 56 | |
| 57 | --- |
| 58 | |
| 59 | ## Gotchas |
| 60 | |
| 61 | - A customer **must have at least one enabled Event Source** before Event Search will work for them. If none exist, a warning banner will appear on the Event Search page. |
| 62 | - Disabling an Event Source hides it from the Event Search dropdown but does not delete it. |
| 63 | - The index pattern must match actual indices in your Wazuh Indexer — double-check the pattern if searches return zero results. |
| 64 | |
| 65 | --- |
| 66 | |
| 67 | ## Next step |
| 68 | |
| 69 | Once an Event Source is configured, head to [Event Search](/user/ui/siem-event-search) to start querying events. |