docs: restructure Mintlify navigation into 5 tabs + role-based entrypoints (#713)
Co-authored-by: Clawdbot <clawdbot@Clawdbots-Mac-mini.local>
taylorcopilot committed
Feb 14, 2026 at 22:16 UTC
4c9c32cd4f9759a8485b6a675c49166ec63686e3
6 files changed
+237
-58
docs/admin/index.mdx
new
+32
@@ -0,0 +1,32 @@
1
+---
2
+title: Admin / Platform Guide
3
+description: Provisioning, integrations/connectors, and platform reliability for CoPilot.
4
+---
5
+
6
+# Admin / Platform Guide
7
+
8
+This section is organized around **data onboarding and reliability**.
9
+
10
+## Start here
11
+
12
+- [Admin/Engineer quickstart](/user/admins-quickstart)
13
+- [First wins (30 minutes)](/getting-started/first-wins)
14
+
15
+## Tenancy & onboarding
16
+
17
+- [Customer provisioning](/user/customer-provisioning)
18
+- [Customers (UI reference)](/user/ui/customers)
19
+
20
+## Integrations & connectors
21
+
22
+- [3rd‑party integrations](/user/ui/external-third-party-integrations)
23
+- [Network connectors](/user/ui/external-network-connectors)
24
+
25
+## Platform health
26
+
27
+- [Indices management](/user/ui/indices-management)
28
+- [Graylog management](/user/ui/graylog-management)
29
+
30
+## Video walkthroughs
31
+
32
+- [Admin/Engineer track videos](/user/videos#adminengineer-track)
docs/docs.json
+79
-58
@@ -17,15 +17,14 @@
17
"navigation": {
18
"tabs": [
19
{
20
- "tab": "User Guide",
20
+ "tab": "Get Started",
21
"groups": [
22
{
23
- "group": "Start here",
23
+ "group": "Welcome",
24
"pages": [
25
"index",
26
- "user/overview",
27
- "user/navigation",
28
- "user/features"
26
+ "getting-started/roles-and-mental-model",
27
+ "getting-started/first-wins"
28
]
29
},
30
{
@@ -36,91 +35,101 @@
35
]
36
},
37
{
39
- "group": "Provisioning",
38
+ "group": "Core concepts",
39
"pages": [
41
- "user/customer-provisioning"
40
+ "user/overview",
41
+ "user/navigation",
42
+ "user/features"
43
]
44
},
45
{
45
- "group": "Videos",
46
+ "group": "Watch next",
47
"pages": [
47
- "user/videos"
48
+ {
49
+ "title": "Operator track videos",
50
+ "href": "/user/videos#operator-track"
51
+ },
52
+ {
53
+ "title": "Admin/Engineer track videos",
54
+ "href": "/user/videos#adminengineer-track"
55
+ }
56
]
57
}
58
]
59
},
60
{
53
- "tab": "UI Guide",
61
+ "tab": "Operator",
62
"groups": [
63
{
56
- "group": "Overview",
64
+ "group": "Start here",
65
"pages": [
58
- "user/ui/overview"
66
+ "operator/index",
67
+ "user/operators-quickstart"
68
]
69
},
70
{
62
- "group": "Incident Management",
71
+ "group": "Incident workflow",
72
"pages": [
64
- "user/ui/incident-management",
73
"user/ui/incident-alerts",
74
"user/ui/incident-cases",
67
- "user/ui/incident-sources"
75
+ "user/ui/artifacts"
76
]
77
},
78
{
71
- "group": "Customers",
79
+ "group": "Reference (by menu)",
80
"pages": [
73
- "user/ui/customers",
74
- "user/ui/external-third-party-integrations",
75
- "user/ui/external-network-connectors"
81
+ "user/ui/incident-management",
82
+ "user/ui/incident-sources"
83
]
84
},
85
{
79
- "group": "Graylog",
86
+ "group": "Videos",
87
"pages": [
81
- "user/ui/graylog",
82
- "user/ui/graylog-management",
83
- "user/ui/graylog-pipelines",
84
- "user/ui/graylog-metrics"
88
+ {
89
+ "title": "Operator track",
90
+ "href": "/user/videos#operator-track"
91
+ },
92
+ "user/videos"
93
]
86
- },
94
+ }
95
+ ]
96
+ },
97
+ {
98
+ "tab": "Admin / Platform",
99
+ "groups": [
100
{
88
- "group": "Indices",
101
+ "group": "Start here",
102
"pages": [
90
- "user/ui/indices",
91
- "user/ui/indices-management",
92
- "user/ui/indices-snapshots"
103
+ "admin/index",
104
+ "user/admins-quickstart",
105
+ "user/customer-provisioning"
106
]
107
},
108
{
96
- "group": "Agents",
109
+ "group": "Integrations & connectors",
110
"pages": [
98
- "user/ui/agents",
99
- "user/ui/agents-groups",
100
- "user/ui/agents-vulnerability-overview",
101
- "user/ui/agents-sca-overview",
102
- "user/ui/agents-sysmon-config",
103
- "user/ui/agents-patch-tuesday",
104
- "user/ui/agents-detection-rules",
105
- "user/ui/agents-copilot-actions"
111
+ "user/ui/external-third-party-integrations",
112
+ "user/ui/external-network-connectors"
113
]
114
},
115
{
109
- "group": "Reports",
116
+ "group": "Platform (by menu)",
117
"pages": [
111
- "user/ui/report-general",
112
- "user/ui/report-creation",
113
- "user/ui/report-sca",
114
- "user/ui/report-vulnerability"
118
+ "user/ui/customers",
119
+ "user/ui/indices-management",
120
+ "user/ui/graylog-management",
121
+ "user/ui/graylog-pipelines",
122
+ "user/ui/graylog-metrics"
123
]
124
},
125
{
118
- "group": "Other",
126
+ "group": "Videos",
127
"pages": [
120
- "user/ui/healthcheck",
121
- "user/ui/scheduler",
122
- "user/ui/artifacts",
123
- "user/ui/customer-portal"
128
+ {
129
+ "title": "Admin/Engineer track",
130
+ "href": "/user/videos#adminengineer-track"
131
+ },
132
+ "user/videos"
133
]
134
}
135
]
@@ -149,26 +158,38 @@
158
"pages": [
159
"integrations/ADDING_A_CONNECTOR"
160
]
161
+ },
162
+ {
163
+ "group": "Videos",
164
+ "pages": [
165
+ {
166
+ "title": "Browse videos",
167
+ "href": "/user/videos"
168
+ }
169
+ ]
170
}
171
]
172
},
173
{
156
- "tab": "GitHub",
174
+ "tab": "Videos",
175
"groups": [
176
{
159
- "group": "Project",
177
+ "group": "Library",
178
+ "pages": [
179
+ "videos/index",
180
+ "user/videos"
181
+ ]
182
+ },
183
+ {
184
+ "group": "Role tracks",
185
"pages": [
186
{
162
- "title": "CoPilot repo",
163
- "href": "https://github.com/socfortress/CoPilot"
164
- },
165
- {
166
- "title": "Releases",
167
- "href": "https://github.com/socfortress/CoPilot/releases"
187
+ "title": "Operator track",
188
+ "href": "/user/videos#operator-track"
189
},
190
{
170
- "title": "Issues",
171
- "href": "https://github.com/socfortress/CoPilot/issues"
191
+ "title": "Admin/Engineer track",
192
+ "href": "/user/videos#adminengineer-track"
193
}
194
]
195
}
docs/getting-started/first-wins.mdx
new
+34
@@ -0,0 +1,34 @@
1
+---
2
+title: First wins (30 minutes)
3
+description: Four fast milestones to prove CoPilot is working end-to-end.
4
+---
5
+
6
+# First wins (30 minutes)
7
+
8
+If you’re onboarding a new environment, aim for these milestones.
9
+
10
+## 1) Operator: triage an alert → open a case
11
+- Go to **Incident Management → Alerts**
12
+- Open an alert and review the context
13
+- Create or link a **Case**
14
+
15
+**Docs:** [Incident alerts](/user/ui/incident-alerts) · [Incident cases](/user/ui/incident-cases)
16
+
17
+**Video track:** [Operator track](/user/videos#operator-track)
18
+
19
+## 2) Admin: provision a customer
20
+Provision a tenant and verify it appears correctly in the Customers view.
21
+
22
+**Docs:** [Customer provisioning](/user/customer-provisioning)
23
+
24
+## 3) Admin: connect an integration / connector
25
+Connect at least one data source and verify it shows up in CoPilot.
26
+
27
+**Docs:**
28
+- [3rd‑party integrations](/user/ui/external-third-party-integrations)
29
+- [Network connectors](/user/ui/external-network-connectors)
30
+
31
+## 4) Validate indices and retention
32
+Make sure the backing indices/patterns exist and data is landing where expected.
33
+
34
+**Docs:** [Indices management](/user/ui/indices-management)
docs/getting-started/roles-and-mental-model.mdx
new
+54
@@ -0,0 +1,54 @@
1
+---
2
+title: Roles & mental model
3
+description: How to think about CoPilot as a SOC operator vs. admin/engineer vs. developer.
4
+---
5
+
6
+# Roles & mental model
7
+
8
+CoPilot is easiest to learn if you separate it into **two jobs**:
9
+
10
+1) **Operate incidents** (alerts → cases → evidence → response)
11
+2) **Make incidents possible** (connect sources/integrations so alerts flow)
12
+
13
+## SOC operator / analyst
14
+
15
+You spend most of your time in **Incident Management**.
16
+
17
+You care about:
18
+- Is this alert real?
19
+- What’s the blast radius?
20
+- What evidence do I need?
21
+- What do I do next?
22
+
23
+**Start here:**
24
+- [Operator quickstart](/user/operators-quickstart)
25
+- [Incident alerts (UI reference)](/user/ui/incident-alerts)
26
+- [Cases (UI reference)](/user/ui/incident-cases)
27
+- Videos: [Operator track](/user/videos#operator-track)
28
+
29
+## Admin / engineer
30
+
31
+You care about **data onboarding and reliability**.
32
+
33
+You care about:
34
+- Are sources connected and healthy?
35
+- Are parsing / streams / pipelines configured correctly?
36
+- Are indices and retention behaving?
37
+- Is each customer/tenant provisioned correctly?
38
+
39
+**Start here:**
40
+- [Admin/Engineer quickstart](/user/admins-quickstart)
41
+- [Customer provisioning](/user/customer-provisioning)
42
+- Videos: [Admin/Engineer track](/user/videos#adminengineer-track)
43
+
44
+## Developer / AI agent
45
+
46
+You are extending or modifying CoPilot.
47
+
48
+You care about:
49
+- Architecture + data flows
50
+- Schema changes (Alembic as source of truth)
51
+- Adding a connector safely
52
+
53
+**Start here:**
54
+- [Developer start here](/developer/start-here)
docs/operator/index.mdx
new
+23
@@ -0,0 +1,23 @@
1
+---
2
+title: Operator Guide
3
+description: Playbooks and workflows for SOC operators and analysts using CoPilot.
4
+---
5
+
6
+# Operator Guide
7
+
8
+This section is organized by **outcomes** (what you’re trying to do), not menu items.
9
+
10
+## Start here
11
+
12
+- [Operator quickstart](/user/operators-quickstart)
13
+- [First wins (30 minutes)](/getting-started/first-wins)
14
+
15
+## Daily workflow
16
+
17
+- [Triage alerts](/user/ui/incident-alerts)
18
+- [Work cases](/user/ui/incident-cases)
19
+- [Artifacts & evidence](/user/ui/artifacts)
20
+
21
+## Video walkthroughs
22
+
23
+- [Operator track videos](/user/videos#operator-track)
docs/videos/index.mdx
new
+15
@@ -0,0 +1,15 @@
1
+---
2
+title: Videos
3
+description: The CoPilot YouTube playlist, summarized and organized by role.
4
+---
5
+
6
+# Videos
7
+
8
+Use the playlist like documentation: each video is linked and summarized into skimmable bullets.
9
+
10
+- [Open the video library](/user/videos)
11
+
12
+## Role-based tracks
13
+
14
+- [Operator track](/user/videos#operator-track)
15
+- [Admin/Engineer track](/user/videos#adminengineer-track)