docs: embed UI screenshots throughout user guide (#706)
Co-authored-by: Clawdbot <clawdbot@Clawdbots-Mac-mini.local>
taylorcopilot committed
Feb 14, 2026 at 18:37 UTC
5c6071202ea9e5000a84b7390efde1519c635c26
5 files changed
+60
docs/user/admins-quickstart.md
+14
@@ -1,5 +1,7 @@
1
# Quickstart (Admins / Engineers)
2
3
+
4
+
5
## Where you spend most of your time
6
7
- **Connectors**: configure connectivity to the toolchain (Wazuh, Graylog, Grafana, Velociraptor, etc.).
@@ -9,16 +11,28 @@
11
## Core workflows
12
13
### 1) Configure connectors
14
+
15
+
16
+
17
- Add URLs / credentials
18
- Verify connectivity
19
20
### 2) Validate SIEM data availability
21
+
22
+
23
+
24
- Confirm Wazuh Indexer is reachable
25
- Confirm Graylog alerts are being written (often `gl-events*`)
26
27
### 3) Provision customer resources (if applicable)
28
+
29
+
30
+
31
- Use customer provisioning flows for Grafana/Graylog/Wazuh/Portainer where supported
32
33
### 4) Operationalize automation
34
+
35
+
36
+
37
- Enable scheduled collectors
38
- Confirm job metadata updates and error handling
docs/user/features.md
+12
@@ -3,6 +3,9 @@
3
This page is intended to make “hidden” features discoverable.
4
5
## Incident Management (operators)
6
+
7
+
8
+
9
- Alerts: triage, tagging, assignment, escalation
10
- Cases: create, link alerts, close lifecycle
11
- Comments: alert comments and case comments
@@ -14,14 +17,23 @@ This page is intended to make “hidden” features discoverable.
17
- Graylog alerting events (commonly `gl-events*`)
18
19
## Integrations / Connectors (engineers)
20
+
21
+
22
+
23
- Connectors: configure and verify tool connectivity
24
- Network connectors: customer-scoped connector configs/keys
25
- Integration settings: customer integration configuration
26
27
## Reporting
28
+
29
+
30
+
31
- Grafana reporting and PDF generation
32
- Case report templates
33
34
## Automation
35
+
36
+
37
+
38
- Scheduler jobs (collectors, sync, alert creation)
39
- Active response (where enabled)
docs/user/navigation.md
+24
@@ -39,6 +39,30 @@ This page explains what each left‑hand navigation item in CoPilot does and how
39
40
## Left navigation map (what each item does)
41
42
+Below are screenshots of the main areas (from a lab environment) to help you quickly recognize where you are in the UI.
43
+
44
+- Overview:
45
+
46
+ 
47
+
48
+- Incident Management → Alerts:
49
+
50
+ 
51
+
52
+- Connectors:
53
+
54
+ 
55
+
56
+- Indices → Index Management:
57
+
58
+ 
59
+
60
+- Graylog → Management:
61
+
62
+ 
63
+
64
+---
65
+
66
### Overview
67
68
- **Overview** → `/overview`
docs/user/operators-quickstart.md
+8
@@ -1,5 +1,7 @@
1
# Quickstart (SOC Operators)
2
3
+
4
+
5
## Where you spend most of your time
6
7
- **Incident Management → Alerts**: triage, investigate, and decide next actions.
@@ -14,10 +16,16 @@
16
- Add comments and assign if needed
17
18
### 2) Create and link a case
19
+
20
+
21
+
22
- Create a case from the alert when it needs tracking
23
- Link related alerts to the same case
24
25
### 3) Attach evidence (artifacts)
26
+
27
+
28
+
29
- Upload case artifacts (files, exports)
30
- Use report templates when generating customer-ready PDFs
31
docs/user/overview.md
+2
@@ -2,6 +2,8 @@
2
3
CoPilot is a “single pane of glass” for operating an open-source SOC/SIEM stack.
4
5
+
6
+
7
## Two primary user roles
8
9
### SOC operator / analyst