8c4d1a3e · cryptotaxi247/CoPilot · siGit Code & Deploy

README.md

+18 -202

@@ -21,225 +21,41 @@ SOCFortress CoPilot

21

22 ## Table of contents

23

24 -- [Getting Started](#getting-started)

25 - - [Running Copilot](#runnning-copilot)

26 - - [Customer Portal (Optional)](#customer-portal-optional)

27 - - [Upgrading Copilot](#upgrading-copilot)

28 -- [Connectors](#connectors)

29 -- [Help](#help)

30 -- [License](#license)

31 -- [Sponsoring](#sponsoring)

24 +- [Getting Started](#getting-started)

25 + - [Install / Upgrade](#install--upgrade)

26 +- [Connectors](#connectors)

27 +- [Help](#help)

28 +- [License](#license)

29 +- [Sponsoring](#sponsoring)

30

31 ## Getting started

32

35 -Copilot's true power comes from the ability to integrate with your existing security stack. We have built in integrations with the following tools:

33 +CoPilot's true power comes from the ability to integrate with your existing security stack. We have built-in integrations with the following tools:

34

37 -- [Wazuh](https://wazuh.com/)

38 -- [Graylog](https://www.graylog.org/)

39 -- [Velociraptor](https://docs.velociraptor.app/)

40 -- [Grafana](https://grafana.com/)

41 -- [InfluxDB](https://www.influxdata.com/)

35 +- [Wazuh](https://wazuh.com/)

36 +- [Graylog](https://www.graylog.org/)

37 +- [Velociraptor](https://docs.velociraptor.app/)

38 +- [Grafana](https://grafana.com/)

39 +- [InfluxDB](https://www.influxdata.com/)

40

43 -❗️ **Note:** Copilot is currently in beta. We are actively working on adding more integrations and features. If you have any suggestions or feedback, please let us know!

41 +❗️ **Note:** CoPilot is currently in beta. We are actively working on adding more integrations and features. If you have any suggestions or feedback, please let us know!

42

45 -### Running Copilot

43 +### Install / Upgrade

44

47 -To ease the installation and upgrades, Copilot is shipped in a single docker container. To run Copilot, you will need to have [Docker](https://docs.docker.com/get-docker/) and [Docker Compose](https://docs.docker.com/compose/install/) installed.

45 +All install + upgrade instructions live in the docs (so the README doesn’t drift):

46

49 -❗ **WARNING:** Copilot is not intended to be exposed to the internet. It is recommended for internal use only.

47 +- **Install / Upgrade docs:** [`docs/getting-started/install-upgrade.mdx`](docs/getting-started/install-upgrade.mdx)

48

51 -🔴 - Helpful docker DNS setting

52 -

53 -```

54 -nano /etc/docker/daemon.json

55 -```

56 -

57 -```json

58 -{

59 - "dns": ["YOUR_DNS_SERVER"],

60 - "log-driver": "json-file",

61 - "log-opts": {

62 - "max-size": "10m",

63 - "max-file": "3"

64 - }

65 -}

66 -```

67 -

68 -### In case you need to set MTU

69 -

70 -```json

71 -{

72 - "dns": ["YOUR_DNS_SERVER"],

73 - "log-driver": "json-file",

74 - "log-opts": {

75 - "max-size": "10m",

76 - "max-file": "3"

77 - },

78 - "mtu": 1450

79 -}

80 -```

81 -

82 -```

83 -systemctl daemon-reload

84 -systemctl restart docker

85 -```

86 -

87 ----

88 -

89 -```bash

90 -# Clone the CoPilot repository

91 -wget https://raw.githubusercontent.com/socfortress/CoPilot/v0.1.5/docker-compose.yml

92 -

93 -# Edit the docker-compose.yml file to set the server name and/or the services you want to use

94 -

95 -# Create the path for storing your data

96 -mkdir data

97 -

98 -# Create the path for copilot-mcp configuration

99 -mkdir -p data/copilot-mcp

100 -

101 -# Create the .env file based on the .env.example

102 -nano .env

103 -

104 -# Run Copilot

105 -docker compose up -d

106 -

107 -# Once Copilot has started up you can retrieve the admin password by running the following command (Only accessible the first time Copilot is started up)

108 -docker logs "$(docker ps --filter ancestor=ghcr.io/socfortress/copilot-backend:latest --format "{{.ID}}")" 2>&1 | grep "Admin user password"

109 -```

110 -

111 -Copilot shall be available on the host interface, port 443, protocol HTTPS - `https://<your_instance_ip>`.

112 -By default, an `admin` account is created. The password is printed in stdout the very first time Copilot is started. It won't be printed anymore after that.

113 -`Admin user password` can be searched in the logs of the `copilot` docker to find the password. You will use the `plain` password to login to the web interface.

114 -

115 -🚀 **YouTube Playlist:** [VIEW THE COPILOT VIDEO SERIES](https://www.youtube.com/watch?v=qQbex2zAhWI&list=PLB6hQ_WpB6U0e5oSLXJMcxmSzz7n3zvD-)

116 -

117 -#### SSL

118 -

119 -By default Copilot uses a self-signed certificate valid for 365 days from install. You can replace the certificate and

120 -key files with your own. These files should be mounted in the `copilot-frontend` container and you can set the path to

121 -your certificate and key files in the `docker-compose.yml` file using the `TLS_CERT_PATH` and `TLS_KEY_PATH`

122 -respectively.

123 -

124 -For Example

49 +Quick upgrade reminder (from your CoPilot directory):

50

51 ```bash

127 -# Generate a certificate e.g.

128 -openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365

129 -```

130 -

131 -Then update the `docker-compose.yml` file to mount the certificate and key files and set the `TLS_CERT_PATH` and `TLS_KEY_PATH` environment variables.

132 -

133 -```yaml

134 -copilot-frontend:

135 - image: ghcr.io/socfortress/copilot-frontend:latest

136 - volumes:

137 - - PATH_TO_YOUR_CERTS:/etc/letsencrypt

138 - environment:

139 - - SERVER_HOST=${SERVER_HOST:-localhost} # Set the domain name of your server

140 - - TLS_CERT_PATH=/etc/letsencrypt/live/${SERVER_HOST}/fullchain.pem # Set the path to your certificate

141 - - TLS_KEY_PATH=/etc/letsencrypt/live/${SERVER_HOST}/privkey.pem # Set the path to your key

142 - ports:

143 - - "80:80"

144 - - "443:443"

145 -```

146 -

147 -### Customer Portal (Optional)

148 -

149 -Copilot includes an optional customer-facing portal that provides a simplified interface for viewing cases, alerts, and agents. This portal is designed for customers or end-users who need visibility into their security operations without access to the full administrative interface.

150 -

151 -#### Features

152 -

153 -- 🔐 **Secure Authentication:** Customer-specific login with role-based access control

154 -- 📊 **Case Management:** View and track security cases assigned to your organization

155 -- 🚨 **Alert Monitoring:** Real-time visibility into security alerts and their status

156 -- 💻 **Agent Overview:** Monitor deployed security agents and their health status

157 -- 📝 **Case Comments:** Collaborate with your security team through case comments

158 -

159 -#### Enabling the Customer Portal

160 -

161 -The customer portal is commented out by default in the `docker-compose.yml` file. To enable it:

162 -

163 -1. **Edit the docker-compose.yml file:**

164 -

165 -```bash

166 -nano docker-compose.yml

167 -```

168 -

169 -2. **Uncomment the customer portal service:**

170 -

171 -```yaml

172 -# Uncomment these lines:

173 -copilot-customer-portal:

174 - image: ghcr.io/socfortress/copilot-customer-portal:latest

175 - environment:

176 - - SERVER_HOST=${SERVER_HOST:-localhost} # Set the domain name of your server

177 - ports:

178 - - "8443:443" # HTTPS access

179 - restart: always

180 -```

181 -

182 -3. **Start the SOCFortress CoPilot stack:**

183 -

184 -```bash

185 -docker compose up -d

186 -```

187 -

188 -4. **Access the customer portal:**

189 -

190 -- **HTTPS:** `https://<your_instance_ip>:8443`

191 -

192 -#### Customer Portal SSL Configuration

193 -

194 -Like the main frontend, the customer portal uses a self-signed certificate by default. To use your own certificate:

195 -

196 -```yaml

197 -copilot-customer-portal:

198 - image: ghcr.io/socfortress/copilot-customer-portal:latest

199 - volumes:

200 - - PATH_TO_YOUR_CERTS:/etc/letsencrypt

201 - environment:

202 - - SERVER_HOST=${SERVER_HOST:-localhost} # Set the domain name of your server

203 - ports:

204 - - "8443:443"

205 -```

206 -

207 -#### Creating Customer Portal Users

208 -

209 -Customer portal users are managed through the main Copilot admin interface:

210 -

211 -1. Log in to the main Copilot interface as an admin

212 -2. Navigate to **Users**

213 -3. Create a new user with the `customer_user` role

214 -4. Assign the user to a specific customer organization

215 -5. The user can now log in to the customer portal using their credentials

216 -

217 -#### Customer Portal Customization

218 -

219 -You can customize the customer portal branding and logo through the main Copilot admin interface:

220 -

221 -1. Navigate to **Customer Portal**

222 -2. Upload your custom logo (supports PNG, JPG, SVG)

223 -3. Set a custom title for the portal

224 -4. Changes are applied immediately to the customer portal

225 -

226 -### Upgrading Copilot

227 -

228 -🛠 You will likely want to upgrade often as we are frequently pushing new changes.

229 -

230 -To upgrade Copilot, you will need to stop the running containers, pull the latest docker image, and start the containers again.

231 -

232 -```bash

233 -# Stop the running container. Make sure you are in the CoPilot directory

52 docker compose pull

235 -

236 -# Start the container again

53 docker compose up -d

54 ```

55

56 ## Connectors

57

242 -Copilot is designed to be a single pane of glass for your security operations. Think of it as a hub for all your security tools. Copilot Connectors are the glue that binds your security tools to Copilot. We take advantage of the APIs and webhooks provided by your security tools to provide a seamless integration.

58 +CoPilot is designed to be a single pane of glass for your security operations. Think of it as a hub for all your security tools. CoPilot Connectors are the glue that binds your security tools to CoPilot. We take advantage of the APIs and webhooks provided by your security tools to provide a seamless integration.

59

60 ## Help

61

docs/admin.mdx

-2

@@ -3,8 +3,6 @@ title: Admin / Platform Guide

3 description: Provisioning, integrations/connectors, and platform reliability for CoPilot.

4 ---

5

6 -# Admin / Platform Guide

7 -

6 This section is organized around **data onboarding and reliability**.

7

8 ## Start here

docs/admin/index.mdx

-2

@@ -3,8 +3,6 @@ title: Admin / Platform Guide

3 description: Provisioning, integrations/connectors, and platform reliability for CoPilot.

4 ---

5

6 -# Admin / Platform Guide

7 -

6 This section is organized around **data onboarding and reliability**.

7

8 ## Start here

docs/customer-portal/index.mdx new

+108

@@ -0,0 +1,108 @@

1 +---

2 +title: Customer Portal

3 +description: Optional customer-facing UI for MSSPs to share alerts/cases, collaborate with customers, and provide real-time visibility.

4 +---

5 +

6 +CoPilot’s **Customer Portal** is an **optional module** designed to bridge the gap between your internal SOC team (the CoPilot “admin” UI) and your external customers.

7 +

8 +It gives customers a clean, scoped interface to:

9 +

10 +- View **alerts** and **cases** that apply to *their* tenant

11 +- Collaborate via **comments** (two-way)

12 +- Track **status** updates (open/closed)

13 +- View **agents/endpoints** associated with their tenant

14 +- Share/receive **case files** (uploads)

15 +

16 +> Security note: treat the Customer Portal as an Internet-facing app **only** when it’s deployed behind a WAF / reverse proxy (and ideally a VPN). If you find security issues, please open a GitHub issue so we can address them.

17 +

18 +---

19 +

20 +## Architecture (high level)

21 +

22 +- **CoPilot Admin UI**: for internal SOC/admin work (full platform visibility)

23 +- **Customer Portal UI**: separate container/service with limited customer-facing functionality

24 +

25 +In Docker Compose, the Customer Portal runs as a **separate service** (separate container) and is typically bound to its own port (commonly `8443`).

26 +

27 +---

28 +

29 +## Enable the Customer Portal (Docker Compose)

30 +

31 +1) Edit your `docker-compose.yml` and uncomment/add the `copilot-customer-portal` service.

32 +

33 +Example:

34 +

35 +```yaml

36 +copilot-customer-portal:

37 + image: ghcr.io/socfortress/copilot-customer-portal:latest

38 + environment:

39 + - SERVER_HOST=${SERVER_HOST:-localhost}

40 + ports:

41 + - "8443:443"

42 + restart: always

43 +```

44 +

45 +2) Pull + start:

46 +

47 +```bash

48 +docker compose pull

49 +docker compose up -d

50 +```

51 +

52 +3) Access:

53 +

54 +- `https://<your_instance_ip_or_hostname>:8443`

55 +

56 +> Recommendation: expose **only** the Customer Portal externally (not the admin UI), and front it with a WAF/reverse proxy.

57 +

58 +---

59 +

60 +## Customize branding (title + logo)

61 +

62 +In the **CoPilot Admin UI**, there is a **Customer Portal** section where you can:

63 +

64 +- Set the portal **title**

65 +- Upload/update the portal **logo**

66 +

67 +These changes are reflected in the customer-facing portal.

68 +

69 +---

70 +

71 +## Create Customer Portal users

72 +

73 +Customer users are created in the **CoPilot Admin UI**:

74 +

75 +1. Go to **Users**

76 +2. **Create user**

77 +3. Select role: `customer_user`

78 +4. Set an initial password (user can change after first login)

79 +

80 +### Assign a user to a customer (tenant)

81 +

82 +After creating the user, **assign them to one or more customers**. Their portal view will only show alerts/cases/agents for the customer(s) they’re assigned.

83 +

84 +---

85 +

86 +## Collaboration model (alerts + cases)

87 +

88 +### Comments (two-way)

89 +

90 +- SOC analysts can comment on an alert/case in the admin UI

91 +- Customers can reply from the Customer Portal

92 +- Both sides see the same comment thread

93 +

94 +### Status updates

95 +

96 +Customers can update alert status (for example, closing an alert after validating remediation). The SOC side will see that status change.

97 +

98 +### Case files

99 +

100 +Cases support file uploads, enabling you to share deliverables/evidence with the customer (and vice versa).

101 +

102 +---

103 +

104 +## Video walkthrough

105 +

106 +This page is based on the Customer Portal walkthrough video:

107 +

108 +- https://youtu.be/_bvFejcFwFM

docs/docs.json

+7

@@ -20,6 +20,7 @@

20 "tab": "Get Started",

21 "pages": [

22 "getting-started/start-here",

23 + "getting-started/install-upgrade",

24 "getting-started/what-is-copilot",

25 "getting-started/roles-and-mental-model",

26 "getting-started/first-wins",

@@ -115,6 +116,12 @@

116 "user/videos"

117 ]

118 },

119 + {

120 + "tab": "Customer Portal",

121 + "pages": [

122 + "customer-portal/index"

123 + ]

124 + },

125 {

126 "tab": "Integrations",

127 "groups": [

docs/getting-started/first-wins.mdx

-2

@@ -3,8 +3,6 @@ title: First wins (30 minutes)

3 description: Four fast milestones to prove CoPilot is working end-to-end.

4 ---

5

6 -# First wins (30 minutes)

7 -

6 If you’re onboarding a new environment, aim for these milestones.

7

8 ## 1) Operator: triage an alert → open a case

docs/getting-started/install-upgrade.mdx new

+243

@@ -0,0 +1,243 @@

1 +---

2 +title: Install / Upgrade

3 +description: Install SOCFortress CoPilot with Docker Compose, retrieve the initial admin password, and safely upgrade.

4 +---

5 +

6 +CoPilot is shipped as Docker images and is intended to be deployed via **Docker Compose**.

7 +

8 +> ❗ WARNING: CoPilot is **not** intended to be exposed directly to the public Internet. Deploy behind a VPN / private network or a properly secured reverse proxy.

9 +

10 +---

11 +

12 +## Prereqs

13 +

14 +- A Linux host (VM or bare metal recommended)

15 +- [Docker Engine](https://docs.docker.com/get-docker/)

16 +- [Docker Compose](https://docs.docker.com/compose/install/)

17 +

18 +---

19 +

20 +## Install (Docker Compose)

21 +

22 +### 1) Get `docker-compose.yml`

23 +

24 +You have two common options:

25 +

26 +**Option A (recommended for most users): clone the repo**

27 +

28 +```bash

29 +git clone https://github.com/socfortress/CoPilot.git

30 +cd CoPilot

31 +```

32 +

33 +**Option B: download just the Compose file for a specific release**

34 +

35 +Replace `<VERSION>` with a release tag (example: `v0.1.5`).

36 +

37 +```bash

38 +wget https://raw.githubusercontent.com/socfortress/CoPilot/<VERSION>/docker-compose.yml

39 +```

40 +

41 +### 2) Create required data paths

42 +

43 +```bash

44 +mkdir -p data

45 +mkdir -p data/copilot-mcp

46 +```

47 +

48 +### 3) Create your `.env`

49 +

50 +Copy from the example and edit as needed:

51 +

52 +```bash

53 +cp .env.example .env

54 +nano .env

55 +```

56 +

57 +At minimum, make sure `SERVER_HOST` is correct for your environment.

58 +

59 +### 4) Start CoPilot

60 +

61 +```bash

62 +docker compose up -d

63 +```

64 +

65 +### 5) Retrieve the initial admin password

66 +

67 +The **admin password is only printed the first time** CoPilot starts.

68 +

69 +```bash

70 +docker logs "$(docker ps --filter ancestor=ghcr.io/socfortress/copilot-backend:latest --format "{{.ID}}")" 2>&1 | grep "Admin user password"

71 +```

72 +

73 +### 6) Access the UI

74 +

75 +CoPilot is available on:

76 +

77 +- `https://<your_instance_ip_or_hostname>` (HTTPS / 443)

78 +

79 +By default, an `admin` account is created.

80 +

81 +---

82 +

83 +## Helpful Docker daemon settings (DNS / logging / MTU)

84 +

85 +If you run into image pulls / name resolution issues, consider configuring Docker DNS and log rotation.

86 +

87 +Edit:

88 +

89 +```bash

90 +nano /etc/docker/daemon.json

91 +```

92 +

93 +Example:

94 +

95 +```json

96 +{

97 + "dns": ["YOUR_DNS_SERVER"],

98 + "log-driver": "json-file",

99 + "log-opts": {

100 + "max-size": "10m",

101 + "max-file": "3"

102 + }

103 +}

104 +```

105 +

106 +If you need to set MTU:

107 +

108 +```json

109 +{

110 + "dns": ["YOUR_DNS_SERVER"],

111 + "log-driver": "json-file",

112 + "log-opts": {

113 + "max-size": "10m",

114 + "max-file": "3"

115 + },

116 + "mtu": 1450

117 +}

118 +```

119 +

120 +Apply:

121 +

122 +```bash

123 +systemctl daemon-reload

124 +systemctl restart docker

125 +```

126 +

127 +---

128 +

129 +## TLS / SSL

130 +

131 +By default, CoPilot uses a **self-signed certificate** valid for 365 days from install.

132 +

133 +To use your own certificate:

134 +

135 +1) Generate/obtain a cert/key.

136 +

137 +```bash

138 +# Example self-signed cert

139 +openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365

140 +```

141 +

142 +2) Mount the certs into `copilot-frontend` and set `TLS_CERT_PATH` / `TLS_KEY_PATH`.

143 +

144 +```yaml

145 +copilot-frontend:

146 + image: ghcr.io/socfortress/copilot-frontend:latest

147 + volumes:

148 + - PATH_TO_YOUR_CERTS:/etc/letsencrypt

149 + environment:

150 + - SERVER_HOST=${SERVER_HOST:-localhost}

151 + - TLS_CERT_PATH=/etc/letsencrypt/live/${SERVER_HOST}/fullchain.pem

152 + - TLS_KEY_PATH=/etc/letsencrypt/live/${SERVER_HOST}/privkey.pem

153 + ports:

154 + - "80:80"

155 + - "443:443"

156 +```

157 +

158 +---

159 +

160 +## Customer Portal (Optional)

161 +

162 +CoPilot includes an optional **customer-facing portal** for end users to view cases, alerts, and agents.

163 +

164 +### Enable the Customer Portal

165 +

166 +In `docker-compose.yml`, the service is commented out by default.

167 +

168 +1) Edit the file:

169 +

170 +```bash

171 +nano docker-compose.yml

172 +```

173 +

174 +2) Uncomment:

175 +

176 +```yaml

177 +copilot-customer-portal:

178 + image: ghcr.io/socfortress/copilot-customer-portal:latest

179 + environment:

180 + - SERVER_HOST=${SERVER_HOST:-localhost}

181 + ports:

182 + - "8443:443"

183 + restart: always

184 +```

185 +

186 +3) Apply:

187 +

188 +```bash

189 +docker compose up -d

190 +```

191 +

192 +4) Access it:

193 +

194 +- `https://<your_instance_ip>:8443`

195 +

196 +### Customer Portal TLS

197 +

198 +Like the main frontend, it uses a self-signed cert by default. To use your own:

199 +

200 +```yaml

201 +copilot-customer-portal:

202 + image: ghcr.io/socfortress/copilot-customer-portal:latest

203 + volumes:

204 + - PATH_TO_YOUR_CERTS:/etc/letsencrypt

205 + environment:

206 + - SERVER_HOST=${SERVER_HOST:-localhost}

207 + ports:

208 + - "8443:443"

209 +```

210 +

211 +### Creating Customer Portal Users

212 +

213 +Customer portal users are managed via the main CoPilot admin interface:

214 +

215 +1. Log in as an admin

216 +2. Navigate to **Users**

217 +3. Create a user with the `customer_user` role

218 +4. Assign the user to the correct customer organization

219 +

220 +---

221 +

222 +## Upgrade

223 +

224 +You’ll likely want to upgrade often as changes ship frequently.

225 +

226 +From your CoPilot directory:

227 +

228 +```bash

229 +docker compose pull

230 +docker compose up -d

231 +```

232 +

233 +If you need a clean restart (rare):

234 +

235 +```bash

236 +# This stops containers but keeps named volumes / bind-mounted data intact.

237 +docker compose down

238 +

239 +docker compose pull

240 +docker compose up -d

241 +```

242 +

243 +> Tip: make sure your persistent `data/` directory is backed up before major upgrades.

docs/getting-started/roles-and-mental-model.mdx

-2

@@ -3,8 +3,6 @@ title: Roles & mental model

3 description: How to think about CoPilot as a SOC operator vs. admin/engineer vs. developer.

4 ---

5

6 -# Roles & mental model

7 -

6 CoPilot is easiest to learn if you separate it into **two jobs**:

7

8 1) **Operate incidents** (alerts → cases → evidence → response)

docs/getting-started/start-here.mdx

-2

@@ -3,8 +3,6 @@ title: Start here

3 description: A guided checklist to get logs flowing, dashboards populated, and alerts/cases working in SOCFortress CoPilot.

4 ---

5

6 -# Start here

7 -

6 This is the **primary onboarding checklist** for CoPilot.

7

8 CoPilot sits on top of an open-source SIEM stack. To get value fast, you want this order:

docs/getting-started/what-is-copilot.mdx

-2

@@ -3,8 +3,6 @@ title: What is CoPilot?

3 description: CoPilot is a single pane of glass for operating and integrating an open-source SOC/SIEM stack.

4 ---

5

6 -# What is CoPilot?

7 -

6 SOCFortress CoPilot is a **single pane of glass** for operating an open‑source SOC/SIEM stack.

7

8 It sits above tools like **Wazuh**, **Graylog**, **Velociraptor**, **Grafana**, and **Shuffle** and helps you:

docs/integrations.mdx

-2

@@ -3,8 +3,6 @@ title: Integrations

3 description: Source-by-source setup guides and expectations for what data, dashboards, and alerts you get in CoPilot.

4 ---

5

6 -# Integrations

7 -

6 This section is a **catalog**.

7

8 Pick a source, follow a short setup guide, then validate that:

docs/integrations/bitdefender.mdx

-2

@@ -3,8 +3,6 @@ title: Bitdefender (GravityZone)

3 description: Ingest Bitdefender GravityZone events into the SOCFortress SIEM stack via the Event Push Service connector.

4 ---

5

6 -# Bitdefender (GravityZone)

7 -

6 ## What this integration is

7

8 This integration ingests **Bitdefender GravityZone** security events into your SIEM stack using GravityZone’s **Event Push Service**.

docs/integrations/carbon-black.mdx

-2

@@ -3,8 +3,6 @@ title: Carbon Black Cloud

3 description: Ingest Carbon Black Cloud alerts into the SOCFortress SIEM stack.

4 ---

5

6 -# Carbon Black Cloud

7 -

6 ## What this integration is

7

8 This integration ingests **VMware Carbon Black Cloud** alert data into your SOCFortress SIEM stack using the Carbon Black Cloud APIs.

docs/integrations/cato-networks.mdx

-2

@@ -3,8 +3,6 @@ title: Cato Networks

3 description: Ingest Cato Networks SASE events into the SOCFortress SIEM stack.

4 ---

5

6 -# Cato Networks

7 -

6 ## What this integration is

7

8 This integration ingests **Cato Networks** events into your SOCFortress SIEM stack using the Cato API (commonly via the `eventsFeed` capability).

docs/integrations/crowdstrike.mdx

-2

@@ -3,8 +3,6 @@ title: CrowdStrike

3 description: Ingest CrowdStrike Falcon events using the Falcon SIEM Connector and route them into your SOCFortress SIEM stack.

4 ---

5

6 -# CrowdStrike

7 -

6 ## What this integration is

7

8 This integration ingests **CrowdStrike Falcon** events into your SOCFortress SIEM stack using the **Falcon SIEM Connector** (FalconHose).

docs/integrations/darktrace.mdx

-2

@@ -3,8 +3,6 @@ title: Darktrace

3 description: Ingest Darktrace alert logs (AI Analyst / Model Breach / System Status) into the SOCFortress SIEM stack.

4 ---

5

6 -# Darktrace

7 -

6 ## What this integration is

7

8 This integration ingests **Darktrace** alert logs into your SOCFortress SIEM stack.

docs/integrations/defender-for-endpoint.mdx

-2

@@ -3,8 +3,6 @@ title: Microsoft Defender for Endpoint

3 description: Ingest Microsoft Defender for Endpoint alerts into the SOCFortress SIEM stack.

4 ---

5

6 -# Microsoft Defender for Endpoint

7 -

6 ## What this integration is

7

8 This integration ingests **Microsoft Defender for Endpoint** alerts via the Defender for Endpoint API.

docs/integrations/duo.mdx

-2

@@ -3,8 +3,6 @@ title: Duo

3 description: Ingest Duo authentication logs into the SOCFortress SIEM stack using the Duo Admin API.

4 ---

5

6 -# Duo

7 -

6 ## What this integration is

7

8 This integration ingests **Duo authentication and admin logs** into your SOCFortress SIEM stack via the **Duo Admin API**.

docs/integrations/huntress.mdx

-2

@@ -3,8 +3,6 @@ title: Huntress

3 description: Ingest Huntress telemetry and operationalize it inside CoPilot.

4 ---

5

6 -# Huntress

7 -

6 ## What this integration is

7

8 Huntress provides managed detection/response-style telemetry that can complement endpoint and identity sources.

docs/integrations/index.mdx

-2

@@ -3,8 +3,6 @@ title: Integrations

3 description: Source-by-source setup guides and expectations for what data, dashboards, and alerts you get in CoPilot.

4 ---

5

6 -# Integrations

7 -

6 This section is a **catalog**.

7

8 Pick a source, follow a short setup guide, then validate that:

docs/integrations/mimecast.mdx

-2

@@ -3,8 +3,6 @@ title: Mimecast

3 description: Ingest Mimecast security events and turn them into dashboards and alerts in CoPilot.

4 ---

5

6 -# Mimecast

7 -

6 ## What this integration is

7

8 Mimecast telemetry provides email security signals (policy actions, suspicious messages, detections) that are useful for SOC alerting and investigation.

docs/integrations/network-connectors.mdx

-2

@@ -3,8 +3,6 @@ title: Network connectors (syslog)

3 description: Vendor-by-vendor syslog ingestion patterns and validation steps.

4 ---

5

6 -# Network connectors (syslog)

7 -

6 Network connectors ingest **syslog events** from firewalls and network devices (and some syslog-forwarding services).

7

8 ## Data path (how it flows)

docs/integrations/network-connectors/cisco-asa.mdx

-2

@@ -2,8 +2,6 @@

2 title: Cisco ASA (syslog)

3 ---

4

5 -# Cisco ASA (syslog)

6 -

5 ## What you get (high level)

6

7 - Firewall connection logs

docs/integrations/network-connectors/fortigate.mdx

-2

@@ -2,8 +2,6 @@

2 title: Fortinet FortiGate (syslog)

3 ---

4

5 -# Fortinet FortiGate (syslog)

6 -

5 ## What you get (high level)

6

7 - Firewall traffic logs

docs/integrations/network-connectors/fortinet.mdx

-2

@@ -3,8 +3,6 @@ title: Fortinet FortiGate (syslog)

3 description: Configure FortiGate to forward logs to your SIEM via syslog.

4 ---

5

6 -# Fortinet FortiGate (syslog)

7 -

6 ## What this connector is

7

8 This connector covers how to configure a **Fortinet FortiGate** firewall to forward logs to your SIEM using **syslog**.

docs/integrations/network-connectors/opnsense.mdx

-2

@@ -3,8 +3,6 @@ title: OPNsense (syslog)

3 description: Configure OPNsense to forward logs to your SIEM via remote syslog.

4 ---

5

6 -# OPNsense (syslog)

7 -

6 ## What this connector is

7

8 This connector covers how to configure **OPNsense** to forward logs to an external syslog server.

docs/integrations/network-connectors/palo-alto.mdx

-2

@@ -2,8 +2,6 @@

2 title: Palo Alto Networks (syslog)

3 ---

4

5 -# Palo Alto Networks (syslog)

6 -

5 ## What you get (high level)

6

7 - Traffic logs

docs/integrations/network-connectors/sentinelone.mdx

-2

@@ -3,8 +3,6 @@ title: SentinelOne (syslog over TLS)

3 description: Forward SentinelOne alerts/events to the SIEM using TLS (mutual auth).

4 ---

5

6 -# SentinelOne (syslog over TLS)

7 -

6 ## What this connector is

7

8 This connector forwards **SentinelOne** alerts and events to your SIEM using **TLS-encrypted syslog** with **mutual authentication**.

docs/integrations/network-connectors/sonicwall.mdx

-2

@@ -3,8 +3,6 @@ title: SonicWall (syslog)

3 description: Forward SonicWall firewall logs to the SIEM via direct syslog or syslog-ng with TLS.

4 ---

5

6 -# SonicWall (syslog)

7 -

6 ## What this connector is

7

8 This connector covers two approaches for forwarding **SonicWall** logs to your SIEM:

docs/integrations/office-365.mdx

-2

@@ -3,8 +3,6 @@ title: Office 365

3 description: Ingest Microsoft 365 audit and sign-in telemetry, then visualize and alert on it in CoPilot.

4 ---

5

6 -# Office 365

7 -

6 ## What this integration is

7

8 Office 365 (Microsoft 365) telemetry is typically **API-collected** audit/sign-in activity that becomes part of your tenant’s SIEM dataset.

docs/integrations/sap-siem.mdx

-2

@@ -3,8 +3,6 @@ title: SAP SIEM (Customer Data Cloud)

3 description: Collect SAP Customer Data Cloud audit events and forward them into the SOCFortress SIEM stack.

4 ---

5

6 -# SAP SIEM (Customer Data Cloud)

7 -

6 ## What this integration is

7

8 This integration collects **audit events** from SAP Customer Data Cloud (Gigya) and forwards them into your SOCFortress SIEM stack.

docs/integrations/wazuh.mdx

-2

@@ -3,8 +3,6 @@ title: Wazuh (endpoints)

3 description: Endpoint log ingestion and security telemetry via Wazuh.

4 ---

5

6 -# Wazuh (endpoints)

7 -

6 ## What this integration is

7

8 Wazuh is the primary endpoint telemetry source in many CoPilot deployments.

docs/operator.mdx

-2

@@ -3,8 +3,6 @@ title: Operator Guide

3 description: Playbooks and workflows for SOC operators and analysts using CoPilot.

4 ---

5

6 -# Operator Guide

7 -

6 This section is organized by **outcomes** (what you’re trying to do), not menu items.

7

8 ## Start here

docs/operator/index.mdx

-2

@@ -3,8 +3,6 @@ title: Operator Guide

3 description: Playbooks and workflows for SOC operators and analysts using CoPilot.

4 ---

5

6 -# Operator Guide

7 -

6 This section is organized by **outcomes** (what you’re trying to do), not menu items.

7

8 ## Start here

docs/power-features.mdx

-2

@@ -3,8 +3,6 @@ title: Power features

3 description: Add-on capabilities that extend CoPilot beyond the core ingest→detect→respond loop.

4 ---

5

6 -# Power features

7 -

6 These features make CoPilot more powerful, but they’re not required for the initial SIEM bring-up.

7

8 If you’re still onboarding, start with the guided checklist: [Start here](/getting-started/start-here).

docs/power-features/ai-analyst.mdx

-2

@@ -3,8 +3,6 @@ title: AI analyst / AI-assisted investigation

3 description: AI-assisted workflows to speed up alert triage, investigation, and knowledge capture across your open-source SIEM stack.

4 ---

5

6 -# AI analyst / AI-assisted investigation

7 -

6 CoPilot’s AI features are designed to reduce context switching and speed up common SOC workflows:

7 - understand an alert faster ("what am I looking at?")

8 - decide what to do next ("benign or investigate?")

docs/power-features/atomic-red-team.mdx

-2

@@ -3,8 +3,6 @@ title: Atomic Red Team (detection simulation)

3 description: Run Atomic Red Team simulations to verify telemetry flow and validate that Wazuh detection rules fire as expected.

4 ---

5

6 -# Atomic Red Team (detection simulation)

7 -

6 Atomic Red Team is a detection validation workflow: you simulate known adversary behaviors (“atomic tests”) and confirm your stack detects what it should.

7

8 In CoPilot, this is commonly used to:

docs/power-features/cloud-security-assessment.mdx

-2

@@ -3,8 +3,6 @@ title: Cloud security assessment (Scout Suite)

3 description: Run Scout Suite scans inside CoPilot to generate cloud posture reports (AWS supported; Azure/GCP may be limited depending on release).

4 ---

5

6 -# Cloud security assessment (Scout Suite)

7 -

6 CoPilot can run **Scout Suite** scans and surface the resulting report inside the UI.

7

8 Scout Suite is an open-source cloud security assessment tool that scans a cloud account via provider APIs, identifies risky configurations, and generates a report with remediation guidance.

docs/power-features/github-audit.mdx

-2

@@ -3,8 +3,6 @@ title: GitHub audit

3 description: Collect and review GitHub audit-related data inside CoPilot.

4 ---

5

6 -# GitHub audit

7 -

6 ## What it is

7

8 CoPilot contains schema and capability to store GitHub audit-related data (wireframe).

docs/power-features/index.mdx

-2

@@ -3,8 +3,6 @@ title: Power features

3 description: Add-on capabilities that extend CoPilot beyond the core ingest→detect→respond loop.

4 ---

5

6 -# Power features

7 -

6 These features make CoPilot more powerful, but they’re not required for the initial SIEM bring-up.

7

8 If you’re still onboarding, start with the guided checklist: [Start here](/getting-started/start-here).

docs/power-features/mitre-attack.mdx

-2

@@ -3,8 +3,6 @@ title: MITRE ATT&CK integration

3 description: Technique-centric investigation and coverage lens powered by MITRE technique enrichment in Wazuh rules.

4 ---

5

6 -# MITRE ATT&CK integration

7 -

6 MITRE ATT&CK in CoPilot gives you a technique-centric lens across alerts/events. It’s useful for:

7 - coverage conversations (“what do we detect?”)

8 - investigation context (“what does this behavior usually mean?”)

docs/power-features/patch-tuesday.mdx

-2

@@ -3,8 +3,6 @@ title: Microsoft Patch Tuesday

3 description: Track and prioritize Microsoft monthly vulnerabilities inside CoPilot.

4 ---

5

6 -# Microsoft Patch Tuesday

7 -

6 ## What it is

7

8 CoPilot includes a Patch Tuesday experience to help operators/admins track and prioritize Microsoft monthly vulnerabilities.

docs/power-features/report-creation.mdx

-2

@@ -3,8 +3,6 @@ title: Report creation

3 description: Generate and export reports (often Grafana dashboards) for customers.

4 ---

5

6 -# Report creation

7 -

6 ## What it is

7

8 CoPilot supports report creation, commonly via Grafana dashboards and PDF generation.

docs/power-features/web-vulnerability-assessment.mdx

-2

@@ -3,8 +3,6 @@ title: Web vulnerability assessment (Nuclei)

3 description: Run Nuclei-based web vulnerability scans inside CoPilot and review findings with request/response detail.

4 ---

5

6 -# Web vulnerability assessment (Nuclei)

7 -

6 CoPilot includes a web vulnerability scanning module powered by **Nuclei**.

7

8 It’s designed to give operators/admins a fast way to validate web exposure and identify common web/app misconfigurations across owned/authorized targets.

docs/reference.mdx

-2

@@ -3,8 +3,6 @@ title: Reference

3 description: Deep links, mental models, and troubleshooting for CoPilot.

4 ---

5

6 -# Reference

7 -

6 Use this section when you need:

7

8 - menu-mirroring UI reference

docs/reference/index.mdx

-2

@@ -3,8 +3,6 @@ title: Reference

3 description: Deep links, mental models, and troubleshooting for CoPilot.

4 ---

5

6 -# Reference

7 -

6 Use this section when you need:

7

8 - menu-mirroring UI reference

docs/reference/troubleshooting.mdx

-2

@@ -3,8 +3,6 @@ title: Troubleshooting index

3 description: Symptom → likely causes → what to check (CoPilot + SIEM stack).

4 ---

5

6 -# Troubleshooting index

7 -

6 This page is a **symptom-based index**. Find what you’re seeing, then follow the checks.

7

8 > Wireframe note: this is intentionally high-level. As we fill docs, each item will link to deeper pages with exact UI clicks and screenshots.

docs/user/capsules/c2-alert-to-containment.mdx

-2

@@ -3,8 +3,6 @@ title: "Step-by-Step IR: From C2 Alert to Full Containment"

3 description: Containment-first playbook for C2 beaconing alerts.

4 ---

5

6 -# Step-by-Step IR: From C2 Alert to Full Containment

7 -

6 **Video:** https://www.youtube.com/watch?v=PUQ3H913xGs

7

8 ## Goal

docs/user/capsules/endpoint-response-actions-copilot.mdx

-2

@@ -3,8 +3,6 @@ title: "Endpoint Response Actions with CoPilot"

3 description: Execute repeatable endpoint response actions and confirm results.

4 ---

5

6 -# Endpoint Response Actions with CoPilot

7 -

6 **Video:** https://www.youtube.com/watch?v=SJjR-2ATRug

7

8 ## Goal

docs/user/capsules/index.mdx

-2

@@ -3,8 +3,6 @@ title: SOCFortress Capsules

3 description: Operator playbooks that walk you from alert → investigation → response using CoPilot.

4 ---

5

6 -# SOCFortress Capsules

7 -

6 Capsules are short, task-focused operator playbooks based on SOCFortress video walkthroughs.

7

8 Use them when you want a **step-by-step path** from an alert to investigation and response inside CoPilot.

docs/user/capsules/rogue-local-admin-accounts.mdx

-2

@@ -3,8 +3,6 @@ title: "Detecting & Removing Rogue Local Admin Accounts"

3 description: Validate and remediate unauthorized local admin changes.

4 ---

5

6 -# Detecting & Removing Rogue Local Admin Accounts

7 -

6 **Video:** https://www.youtube.com/watch?v=ogJMUFMOXLY

7

8 ## Goal

docs/user/capsules/suspicious-scheduled-tasks.mdx

-2

@@ -3,8 +3,6 @@ title: "SOC Playbook: Detecting and Removing Suspicious Scheduled Tasks"

3 description: Investigate scheduled task persistence alerts and remove malicious tasks.

4 ---

5

6 -# SOC Playbook: Detecting and Removing Suspicious Scheduled Tasks

7 -

6 **Video:** https://www.youtube.com/watch?v=5xHxhSBROEc

7

8 ## Goal

docs/user/capsules/validate-detections-atomic-red-team.mdx

-2

@@ -3,8 +3,6 @@ title: "Validate Detections with Atomic Red Team (CoPilot)"

3 description: Run controlled simulations to confirm detection rules fire as expected.

4 ---

5

6 -# Validate Detections with Atomic Red Team (CoPilot)

7 -

6 **Video:** https://www.youtube.com/watch?v=HXnT-wnpxuQ

7

8 ## Goal

docs/user/capsules/volatility-3-malware-hunting.mdx

-2

@@ -3,8 +3,6 @@ title: "Volatility 3 Malware Hunting (Full Tutorial)"

3 description: Memory-forensics workflow for malware hunting using Volatility 3.

4 ---

5

6 -# Volatility 3 Malware Hunting (Full Tutorial)

7 -

6 **Video:** https://www.youtube.com/watch?v=R1X8V9yy_Y4

7

8 ## Goal

docs/videos.mdx

-2

@@ -3,8 +3,6 @@ title: Videos

3 description: The CoPilot YouTube playlist, summarized and organized by role.

4 ---

5

6 -# Videos

7 -

6 Use the playlist like documentation: each video is linked and summarized into skimmable bullets.

7

8 - [Open the video library](/user/videos)

docs/videos/index.mdx

-2

@@ -3,8 +3,6 @@ title: Videos

3 description: The CoPilot YouTube playlist, summarized and organized by role.

4 ---

5

6 -# Videos

7 -

6 Use the playlist like documentation: each video is linked and summarized into skimmable bullets.

7

8 - [Open the video library](/user/videos)

docs: add Install / Upgrade guide (#720)