docs: add customer provisioning guide (#707)
Co-authored-by: Clawdbot <clawdbot@Clawdbots-Mac-mini.local>
taylorcopilot committed
Feb 14, 2026 at 21:21 UTC
9800d22cfacfaaad4f29f58eb163a642002c904c
2 files changed
+124
docs/user/customer-provisioning.md
new
+123
@@ -0,0 +1,123 @@
1
+# Customer Provisioning (Tenancy Setup)
2
+
3
+Customer provisioning is the **admin/engineer workflow** for onboarding a new customer/tenant into CoPilot and the surrounding OSS SIEM stack.
4
+
5
+Provisioning is designed to create the *plumbing* that makes customer data land in the right place and makes dashboards usable immediately.
6
+
7
+
8
+
9
+---
10
+
11
+## What provisioning sets up
12
+
13
+When you provision a customer, CoPilot will typically create:
14
+
15
+### 1) Dedicated customer index + routing (Graylog → Wazuh Indexer)
16
+
17
+- A **customer-specific index** (for example: `wazuh-<customer_code>`) with your chosen:
18
+ - shards
19
+ - replicas
20
+ - retention (days of hot data)
21
+
22
+- A **Graylog stream** for the customer’s events
23
+
24
+- Stream rules that match on the customer identifier (commonly `agent.labels.customer == <customer_code>`)
25
+
26
+- Stream → pipeline assignment so the customer’s data gets the expected normalization used by dashboards
27
+
28
+> Why this matters: If events don’t route into the correct per-customer index, everything downstream breaks (alerts, dashboards, searching, reporting).
29
+
30
+### 2) Wazuh agent groups (per OS)
31
+
32
+Provisioning creates Wazuh groups that encode the customer identity, typically one per OS:
33
+
34
+- `Windows-<customer_code>`
35
+- `Linux-<customer_code>`
36
+- `macOS-<customer_code>`
37
+
38
+Agents enrolled into the customer’s group will emit events tagged with the customer label, enabling Graylog/Indexer routing.
39
+
40
+### 3) Grafana organization + dashboards
41
+
42
+Provisioning creates (or configures) in Grafana:
43
+
44
+- A **Grafana organization** for the customer (recommended: same as the customer name/code)
45
+- An **OpenSearch data source** pointing at the customer’s index pattern (wildcarded for Graylog daily rotation)
46
+- A dashboards folder (for example: **EDR**) with default Wazuh dashboards
47
+
48
+> This is the big win: the customer gets dashboards immediately without hand-building them.
49
+
50
+---
51
+
52
+## Prerequisites
53
+
54
+Before provisioning, verify connectivity in **Connectors**:
55
+
56
+- Graylog
57
+- Wazuh Manager
58
+- Grafana
59
+- (Wazuh Indexer / OpenSearch)
60
+
61
+If any connector is not verified, provisioning may partially fail.
62
+
63
+---
64
+
65
+## The two key fields: Customer Name vs Customer Code
66
+
67
+### Customer Code (most important)
68
+
69
+The **customer code** is the value used across the stack to correlate data to the correct tenant.
70
+
71
+Common approach:
72
+- use a short, stable, lowercase code (examples: `acme`, `contoso`, `socfortress-lab`)
73
+- avoid spaces (use `-`)
74
+
75
+> Once you provision with a customer code, treat it as **immutable**. Changing it later usually means re-provisioning or migrating data.
76
+
77
+### Customer Name
78
+
79
+The customer name is a human-friendly label (UI display, Grafana org naming convention, etc.).
80
+
81
+---
82
+
83
+## Step-by-step: Provision a customer
84
+
85
+High-level flow (matches the provisioning wizard shown in the video below):
86
+
87
+1) Go to **Customers** and create the customer
88
+2) (If required) set defaults like the **Grafana URL**
89
+3) Open the customer details and choose **Provision**
90
+4) Configure Grafana org name
91
+5) Configure index settings (name, shards, replicas, retention)
92
+6) Select which dashboards to provision
93
+7) Submit and wait for provisioning to complete
94
+
95
+After provisioning, validate the results in:
96
+
97
+- **Graylog**: index exists, stream exists, stream rules look correct, stream is assigned to the Wazuh processing pipeline
98
+- **Wazuh Manager**: customer OS groups exist
99
+- **Grafana**: org exists, OpenSearch data source exists, dashboards folder exists
100
+
101
+---
102
+
103
+## Validation checklist (quick)
104
+
105
+- [ ] New customer appears in **Customers**
106
+- [ ] Graylog customer index exists and matches naming convention
107
+- [ ] Graylog stream exists for the customer and stream rules match the customer label
108
+- [ ] Customer stream is assigned to the Wazuh pipeline (normalization)
109
+- [ ] Wazuh groups exist (Windows/Linux/macOS) and include the customer label
110
+- [ ] Grafana org exists
111
+- [ ] Grafana OpenSearch data source index pattern uses wildcard (to include daily rotated indices)
112
+- [ ] Default dashboards exist under the customer org
113
+
114
+---
115
+
116
+## Video walkthrough (source)
117
+
118
+This guide is based on the customer provisioning walkthrough:
119
+
120
+- **“Wazuh Dashboards in Grafana & Customer Provisioning in CoPilot!”**
121
+ - https://www.youtube.com/watch?v=hC0JHY5WF-U
122
+
123
+(We intentionally store **summaries** in docs and do not commit raw transcripts.)
mkdocs.yml
+1
@@ -75,6 +75,7 @@ nav:
75
- Overview: user/overview.md
76
- Quickstart (Operators): user/operators-quickstart.md
77
- Quickstart (Admins/Engineers): user/admins-quickstart.md
78
+ - Customer Provisioning (Tenancy): user/customer-provisioning.md
79
- Features by Area: user/features.md
80
- Navigation Guide (UI): user/navigation.md
81
- Videos (Playlist): user/videos.md