@cryptotaxi247 / CoPilot / commits / 9800d22c

docs: add customer provisioning guide (#707)

Co-authored-by: Clawdbot <clawdbot@Clawdbots-Mac-mini.local>

taylorcopilot committed Feb 14, 2026 at 21:21 UTC 9800d22cfacfaaad4f29f58eb163a642002c904c
2 files changed +124
docs/user/customer-provisioning.md new
+123
@@ -0,0 +1,123 @@
1 +# Customer Provisioning (Tenancy Setup)
2 +
3 +Customer provisioning is the **admin/engineer workflow** for onboarding a new customer/tenant into CoPilot and the surrounding OSS SIEM stack.
4 +
5 +Provisioning is designed to create the *plumbing* that makes customer data land in the right place and makes dashboards usable immediately.
6 +
7 +![Customers](../assets/ui/customers.png)
8 +
9 +---
10 +
11 +## What provisioning sets up
12 +
13 +When you provision a customer, CoPilot will typically create:
14 +
15 +### 1) Dedicated customer index + routing (Graylog → Wazuh Indexer)
16 +
17 +- A **customer-specific index** (for example: `wazuh-<customer_code>`) with your chosen:
18 + - shards
19 + - replicas
20 + - retention (days of hot data)
21 +
22 +- A **Graylog stream** for the customer’s events
23 +
24 +- Stream rules that match on the customer identifier (commonly `agent.labels.customer == <customer_code>`)
25 +
26 +- Stream → pipeline assignment so the customer’s data gets the expected normalization used by dashboards
27 +
28 +> Why this matters: If events don’t route into the correct per-customer index, everything downstream breaks (alerts, dashboards, searching, reporting).
29 +
30 +### 2) Wazuh agent groups (per OS)
31 +
32 +Provisioning creates Wazuh groups that encode the customer identity, typically one per OS:
33 +
34 +- `Windows-<customer_code>`
35 +- `Linux-<customer_code>`
36 +- `macOS-<customer_code>`
37 +
38 +Agents enrolled into the customer’s group will emit events tagged with the customer label, enabling Graylog/Indexer routing.
39 +
40 +### 3) Grafana organization + dashboards
41 +
42 +Provisioning creates (or configures) in Grafana:
43 +
44 +- A **Grafana organization** for the customer (recommended: same as the customer name/code)
45 +- An **OpenSearch data source** pointing at the customer’s index pattern (wildcarded for Graylog daily rotation)
46 +- A dashboards folder (for example: **EDR**) with default Wazuh dashboards
47 +
48 +> This is the big win: the customer gets dashboards immediately without hand-building them.
49 +
50 +---
51 +
52 +## Prerequisites
53 +
54 +Before provisioning, verify connectivity in **Connectors**:
55 +
56 +- Graylog
57 +- Wazuh Manager
58 +- Grafana
59 +- (Wazuh Indexer / OpenSearch)
60 +
61 +If any connector is not verified, provisioning may partially fail.
62 +
63 +---
64 +
65 +## The two key fields: Customer Name vs Customer Code
66 +
67 +### Customer Code (most important)
68 +
69 +The **customer code** is the value used across the stack to correlate data to the correct tenant.
70 +
71 +Common approach:
72 +- use a short, stable, lowercase code (examples: `acme`, `contoso`, `socfortress-lab`)
73 +- avoid spaces (use `-`)
74 +
75 +> Once you provision with a customer code, treat it as **immutable**. Changing it later usually means re-provisioning or migrating data.
76 +
77 +### Customer Name
78 +
79 +The customer name is a human-friendly label (UI display, Grafana org naming convention, etc.).
80 +
81 +---
82 +
83 +## Step-by-step: Provision a customer
84 +
85 +High-level flow (matches the provisioning wizard shown in the video below):
86 +
87 +1) Go to **Customers** and create the customer
88 +2) (If required) set defaults like the **Grafana URL**
89 +3) Open the customer details and choose **Provision**
90 +4) Configure Grafana org name
91 +5) Configure index settings (name, shards, replicas, retention)
92 +6) Select which dashboards to provision
93 +7) Submit and wait for provisioning to complete
94 +
95 +After provisioning, validate the results in:
96 +
97 +- **Graylog**: index exists, stream exists, stream rules look correct, stream is assigned to the Wazuh processing pipeline
98 +- **Wazuh Manager**: customer OS groups exist
99 +- **Grafana**: org exists, OpenSearch data source exists, dashboards folder exists
100 +
101 +---
102 +
103 +## Validation checklist (quick)
104 +
105 +- [ ] New customer appears in **Customers**
106 +- [ ] Graylog customer index exists and matches naming convention
107 +- [ ] Graylog stream exists for the customer and stream rules match the customer label
108 +- [ ] Customer stream is assigned to the Wazuh pipeline (normalization)
109 +- [ ] Wazuh groups exist (Windows/Linux/macOS) and include the customer label
110 +- [ ] Grafana org exists
111 +- [ ] Grafana OpenSearch data source index pattern uses wildcard (to include daily rotated indices)
112 +- [ ] Default dashboards exist under the customer org
113 +
114 +---
115 +
116 +## Video walkthrough (source)
117 +
118 +This guide is based on the customer provisioning walkthrough:
119 +
120 +- **“Wazuh Dashboards in Grafana & Customer Provisioning in CoPilot!”**
121 + - https://www.youtube.com/watch?v=hC0JHY5WF-U
122 +
123 +(We intentionally store **summaries** in docs and do not commit raw transcripts.)
mkdocs.yml
+1
@@ -75,6 +75,7 @@ nav:
75 - Overview: user/overview.md
76 - Quickstart (Operators): user/operators-quickstart.md
77 - Quickstart (Admins/Engineers): user/admins-quickstart.md
78 + - Customer Provisioning (Tenancy): user/customer-provisioning.md
79 - Features by Area: user/features.md
80 - Navigation Guide (UI): user/navigation.md
81 - Videos (Playlist): user/videos.md