docs: split video guide into operator vs admin tracks (#699)
Co-authored-by: Clawdbot <clawdbot@Clawdbots-Mac-mini.local>
taylorcopilot committed
Feb 14, 2026 at 11:21 UTC
bca27ed43b5124372c5bbffe959e50e552ed4f9e
1 file changed
+498
-145
docs/user/videos.md
+498
-145
@@ -1,10 +1,405 @@
1
# CoPilot Video Guide
2
3
-Use this page as a fast path through the CoPilot video library. Start with the first sections if you are new, then jump to integration or advanced workflows based on your role. Each entry summarizes what is shown, key features, and who benefits most.
3
+This page is generated from the CoPilot YouTube playlist transcripts and is meant to be used like documentation.
4
5
-## Start Here: Platform Overview and Installation
5
+## How to use this page
6
7
-### Copilot - Your Open Source Security Integrator
7
+- Start with the section that matches your role.
8
+- Videos labeled **Best for: Both** appear in *both* tracks below (by design).
9
+
10
+## Operator Track (SOC operators / analysts)
11
+
12
+Alert triage, case work, investigations, and day-to-day SOC workflows.
13
+
14
+### Core SOC Workflows: Alerting, Case Management, and Investigations
15
+
16
+#### Wazuh Content Pack For Graylog - Easily Configure Your SOCFortress SIEM Stack
17
+- Link: https://www.youtube.com/watch?v=euFrHP0VkD8
18
+- Best for: Both
19
+- What you learn:
20
+ - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
21
+ - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
22
+ - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
23
+ - Shows connector setup steps and validation inside CoPilot.
24
+ - Highlights required service reload/restart points after configuration changes.
25
+ - Demonstrates alert flow from detection source into CoPilot incident views.
26
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
27
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
28
+- Key CoPilot features shown: Wazuh integration, Graylog connector, Grafana integration, Incident management, Alert triage UI
29
+
30
+#### Wazuh Security Configuration Assessment and CoPilot - Are Your Endpoints Compliant?
31
+- Link: https://www.youtube.com/watch?v=ffAnV31Ne54
32
+- Best for: Both
33
+- What you learn:
34
+ - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
35
+ - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
36
+ - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
37
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
38
+ - Uses API-driven actions to push, pull, or validate security operations data.
39
+ - Shows practical filtering/search techniques for triage speed.
40
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
41
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
42
+- Key CoPilot features shown: Wazuh integration, SCA visibility, Incident management, Alert triage UI
43
+
44
+#### Powerful Wazuh Alert Management With CoPilot!
45
+- Link: https://www.youtube.com/watch?v=3p6qiH9UF8U
46
+- Best for: Operator
47
+- What you learn:
48
+ - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
49
+ - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
50
+ - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
51
+ - Breaks down alert lifecycle handling and practical techniques for reducing analyst overload.
52
+ - Shows connector setup steps and validation inside CoPilot.
53
+ - Demonstrates alert flow from detection source into CoPilot incident views.
54
+ - Explains how index/search data is selected and mapped for operations.
55
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
56
+- Key CoPilot features shown: Wazuh integration, Built-in case management, Incident management, Alert triage UI
57
+
58
+#### Introducing the Datastore in CoPilot: Upload Artifacts into Cases with Ease
59
+- Link: https://www.youtube.com/watch?v=GwPyKM2X1EM
60
+- Best for: Operator
61
+- What you learn:
62
+ - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
63
+ - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
64
+ - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
65
+ - Demonstrates uploading and attaching investigation artifacts directly into cases for evidence continuity.
66
+ - Walks through Docker Compose or service-level deployment changes.
67
+ - Demonstrates alert flow from detection source into CoPilot incident views.
68
+ - Demonstrates customer-aware workflows and tenant context handling.
69
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
70
+- Key CoPilot features shown: Case datastore/artifact uploads, Incident management, Alert triage UI
71
+
72
+#### Supercharge Open-Source Cybersecurity: Velociraptor + Sigma for Your SIEM
73
+- Link: https://www.youtube.com/watch?v=S2ELWusHcxA
74
+- Best for: Both
75
+- What you learn:
76
+ - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
77
+ - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
78
+ - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
79
+ - Demonstrates alert flow from detection source into CoPilot incident views.
80
+ - Explains how index/search data is selected and mapped for operations.
81
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
82
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
83
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
84
+- Key CoPilot features shown: Velociraptor integration, Sigma rule workflow, SCA visibility, Incident management, Alert triage UI
85
+
86
+#### Open Source SIEM Response | Dynamic Endpoint Actions with SOCFortress CoPilot
87
+- Link: https://www.youtube.com/watch?v=l9OLtgemYOQ
88
+- Best for: Both
89
+- What you learn:
90
+ - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
91
+ - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
92
+ - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
93
+ - Explains how index/search data is selected and mapped for operations.
94
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
95
+ - Uses API-driven actions to push, pull, or validate security operations data.
96
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
97
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
98
+- Key CoPilot features shown: Velociraptor integration, Active response automation, Vulnerability visibility, Incident management, Alert triage UI
99
+
100
+#### Endpoint Investigation Made Easier: New Velociraptor Features in SOCFORTRESS CoPilot
101
+- Link: https://www.youtube.com/watch?v=R_pG1Gx_7O8
102
+- Best for: Operator
103
+- What you learn:
104
+ - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
105
+ - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
106
+ - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
107
+ - Demonstrates alert flow from detection source into CoPilot incident views.
108
+ - Uses API-driven actions to push, pull, or validate security operations data.
109
+ - Connects alert context to endpoint/asset details for analyst decision making.
110
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
111
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
112
+- Key CoPilot features shown: Velociraptor integration, Incident management, Alert triage UI
113
+
114
+### AI Analyst and Assistant Workflows
115
+
116
+#### AI Analyst for Wazuh Alerts: Revolutionize Your SOC with SOCFortress Copilot!
117
+- Link: https://www.youtube.com/watch?v=-2srPC-Dw-0
118
+- Best for: Both
119
+- What you learn:
120
+ - Demonstrates natural-language investigation workflows that reduce manual querying in backend systems.
121
+ - Shows how AI responses can accelerate common SOC questions and operational checks.
122
+ - Covers the boundary between assisted analysis and operator validation for reliable decisions.
123
+ - Shows guided querying against CoPilot and backend systems using natural language prompts.
124
+ - Demonstrates alert flow from detection source into CoPilot incident views.
125
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
126
+ - Connects alert context to endpoint/asset details for analyst decision making.
127
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
128
+- Key CoPilot features shown: Wazuh integration, AI analyst, AI-assisted investigation
129
+
130
+#### AI Agent for Open Source SIEM: Wazuh, Velociraptor + CoPilot!
131
+- Link: https://www.youtube.com/watch?v=FHjD9QBaLD4
132
+- Best for: Both
133
+- What you learn:
134
+ - Demonstrates natural-language investigation workflows that reduce manual querying in backend systems.
135
+ - Shows how AI responses can accelerate common SOC questions and operational checks.
136
+ - Covers the boundary between assisted analysis and operator validation for reliable decisions.
137
+ - Shows guided querying against CoPilot and backend systems using natural language prompts.
138
+ - Walks through Docker Compose or service-level deployment changes.
139
+ - Demonstrates alert flow from detection source into CoPilot incident views.
140
+ - Explains how index/search data is selected and mapped for operations.
141
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
142
+- Key CoPilot features shown: Wazuh integration, Velociraptor integration, AI agent, AI-assisted investigation
143
+
144
+#### AI Chatbot Now With Threat Intel, Cyber News, Knowledge Base & Attack Surface!
145
+- Link: https://www.youtube.com/watch?v=QaLrmSgEcLI
146
+- Best for: Both
147
+- What you learn:
148
+ - Demonstrates natural-language investigation workflows that reduce manual querying in backend systems.
149
+ - Shows how AI responses can accelerate common SOC questions and operational checks.
150
+ - Covers the boundary between assisted analysis and operator validation for reliable decisions.
151
+ - Shows guided querying against CoPilot and backend systems using natural language prompts.
152
+ - Explains how index/search data is selected and mapped for operations.
153
+ - Uses API-driven actions to push, pull, or validate security operations data.
154
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
155
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
156
+- Key CoPilot features shown: Velociraptor integration, AI chatbot, AI-assisted investigation
157
+
158
+### Detection Engineering and Response Automation
159
+
160
+#### Automate Your SOC: Triggering Alerts with Wazuh Rules via Copilot
161
+- Link: https://www.youtube.com/watch?v=tguRiVgytso
162
+- Best for: Both
163
+- What you learn:
164
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
165
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
166
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
167
+ - Shows connector setup steps and validation inside CoPilot.
168
+ - Walks through Docker Compose or service-level deployment changes.
169
+ - Demonstrates alert flow from detection source into CoPilot incident views.
170
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
171
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
172
+- Key CoPilot features shown: Wazuh integration, Detection tuning
173
+
174
+#### Wazuh Rule Writing With CoPilot AI Module - Handle Your Alert Flooding
175
+- Link: https://www.youtube.com/watch?v=AH1g3p8s2_o
176
+- Best for: Both
177
+- What you learn:
178
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
179
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
180
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
181
+ - Shows rule editing/tuning workflow so detections can be refined without leaving CoPilot.
182
+ - Walks through Docker Compose or service-level deployment changes.
183
+ - Highlights required service reload/restart points after configuration changes.
184
+ - Demonstrates alert flow from detection source into CoPilot incident views.
185
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
186
+- Key CoPilot features shown: Wazuh integration, Detection tuning
187
+
188
+#### Mastering Wazuh's Active Response: Block Malicious IPs with CoPilot & Wazuh!
189
+- Link: https://www.youtube.com/watch?v=llm3uSSUhqs
190
+- Best for: Both
191
+- What you learn:
192
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
193
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
194
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
195
+ - Demonstrates response actions tied to detections, including safer execution and control boundaries.
196
+ - Highlights required service reload/restart points after configuration changes.
197
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
198
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
199
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
200
+- Key CoPilot features shown: Wazuh integration, Active response automation, Detection tuning
201
+
202
+#### Revolutionize Your SIEM Alerts: Integrate CoPilot & Shuffle
203
+- Link: https://www.youtube.com/watch?v=Ko5jLfkSCrk
204
+- Best for: Both
205
+- What you learn:
206
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
207
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
208
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
209
+ - Shows SOC automation orchestration by connecting CoPilot-driven alerts with Shuffle playbooks.
210
+ - Shows connector setup steps and validation inside CoPilot.
211
+ - Demonstrates alert flow from detection source into CoPilot incident views.
212
+ - Demonstrates customer-aware workflows and tenant context handling.
213
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
214
+- Key CoPilot features shown: Shuffle SOAR integration, Detection tuning
215
+
216
+#### Tame the Noise: Sigma Exclusions in CoPilot for Velociraptor Alerts
217
+- Link: https://www.youtube.com/watch?v=GWTNA-6Z_Tk
218
+- Best for: Both
219
+- What you learn:
220
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
221
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
222
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
223
+ - Demonstrates alert flow from detection source into CoPilot incident views.
224
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
225
+ - Demonstrates customer-aware workflows and tenant context handling.
226
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
227
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
228
+- Key CoPilot features shown: Velociraptor integration, Sigma rule workflow, Sysmon config management, Detection tuning
229
+
230
+#### 🚀 Master Sysmon Config Management with CoPilot & Wazuh!
231
+- Link: https://www.youtube.com/watch?v=XT1d49HTqQw
232
+- Best for: Both
233
+- What you learn:
234
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
235
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
236
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
237
+ - Shows connector setup steps and validation inside CoPilot.
238
+ - Highlights required service reload/restart points after configuration changes.
239
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
240
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
241
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
242
+- Key CoPilot features shown: Wazuh integration, Sysmon config management, Detection tuning
243
+
244
+#### Supercharge Wazuh Active Response with CoPilot: No More Limits!
245
+- Link: https://www.youtube.com/watch?v=Ogr70DWAeTc
246
+- Best for: Both
247
+- What you learn:
248
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
249
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
250
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
251
+ - Demonstrates response actions tied to detections, including safer execution and control boundaries.
252
+ - Highlights required service reload/restart points after configuration changes.
253
+ - Demonstrates alert flow from detection source into CoPilot incident views.
254
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
255
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
256
+- Key CoPilot features shown: Wazuh integration, Active response automation, Detection tuning
257
+
258
+#### Test Your Wazuh Detection Rules: One-Click Atomic Red Team + Velociraptor + CoPilot
259
+- Link: https://www.youtube.com/watch?v=TMJOBATTK9M
260
+- Best for: Both
261
+- What you learn:
262
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
263
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
264
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
265
+ - Shows rule editing/tuning workflow so detections can be refined without leaving CoPilot.
266
+ - Uses adversary simulation to validate that detection logic and alert routing behave as expected.
267
+ - Demonstrates alert flow from detection source into CoPilot incident views.
268
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
269
+ - Shows practical filtering/search techniques for triage speed.
270
+- Key CoPilot features shown: Wazuh integration, Velociraptor integration, Atomic Red Team testing, Detection rule management, Detection tuning
271
+
272
+#### Simulate Linux Attacks and Tune Detection Rules with Atomic Red Team
273
+- Link: https://www.youtube.com/watch?v=tL3oNEx_3M8
274
+- Best for: Both
275
+- What you learn:
276
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
277
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
278
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
279
+ - Shows rule editing/tuning workflow so detections can be refined without leaving CoPilot.
280
+ - Uses adversary simulation to validate that detection logic and alert routing behave as expected.
281
+ - Highlights required service reload/restart points after configuration changes.
282
+ - Demonstrates alert flow from detection source into CoPilot incident views.
283
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
284
+- Key CoPilot features shown: Atomic Red Team testing, Detection rule management, Detection tuning
285
+
286
+### Threat Intelligence, Vulnerability, and Security Posture
287
+
288
+#### Auto-Enrich Wazuh Events with Threat Intel Feeds!
289
+- Link: https://www.youtube.com/watch?v=FJunzP2c_mQ
290
+- Best for: Both
291
+- What you learn:
292
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
293
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
294
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
295
+ - Demonstrates alert flow from detection source into CoPilot incident views.
296
+ - Explains how index/search data is selected and mapped for operations.
297
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
298
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
299
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
300
+- Key CoPilot features shown: Wazuh integration, Enrichment workflows
301
+
302
+#### Analyzing Processes in Wazuh Alerts with Advanced Risk Scoring from Global Data
303
+- Link: https://www.youtube.com/watch?v=CVVj9HRtjOE
304
+- Best for: Both
305
+- What you learn:
306
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
307
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
308
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
309
+ - Demonstrates alert flow from detection source into CoPilot incident views.
310
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
311
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
312
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
313
+- Key CoPilot features shown: Wazuh integration, Enrichment workflows
314
+
315
+#### Simplify Cloud Security: ScoutSuite and Copilot Tutorial
316
+- Link: https://www.youtube.com/watch?v=G3MDJSMvnRo
317
+- Best for: Both
318
+- What you learn:
319
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
320
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
321
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
322
+ - Demonstrates customer-aware workflows and tenant context handling.
323
+ - Uses API-driven actions to push, pull, or validate security operations data.
324
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
325
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
326
+- Key CoPilot features shown: SCA visibility, Enrichment workflows
327
+
328
+#### Integrate EPSS with Wazuh for Top-Notch Vulnerability Management!
329
+- Link: https://www.youtube.com/watch?v=Qnm9SXVJGWw
330
+- Best for: Both
331
+- What you learn:
332
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
333
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
334
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
335
+ - Connects exposure data to prioritization so teams can address the highest-risk items first.
336
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
337
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
338
+- Key CoPilot features shown: Wazuh integration, EPSS enrichment, Vulnerability visibility, Enrichment workflows
339
+
340
+#### Enhancing Web App Security: Integrating Copilot with Nuclei for Vulnerability Scanning
341
+- Link: https://www.youtube.com/watch?v=-SVHKuQUxlI
342
+- Best for: Both
343
+- What you learn:
344
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
345
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
346
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
347
+ - Connects exposure data to prioritization so teams can address the highest-risk items first.
348
+ - Walks through Docker Compose or service-level deployment changes.
349
+ - Uses API-driven actions to push, pull, or validate security operations data.
350
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
351
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
352
+- Key CoPilot features shown: DUO MFA ingestion, Nuclei scanning integration, SCA visibility, Vulnerability visibility, Enrichment workflows
353
+
354
+#### Boost CoPilot: IoCs from Wazuh + VirusTotal Enrichment
355
+- Link: https://www.youtube.com/watch?v=fNybop2FTRE
356
+- Best for: Both
357
+- What you learn:
358
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
359
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
360
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
361
+ - Shows malware/IoC enrichment flow and how reputation context changes triage decisions.
362
+ - Shows connector setup steps and validation inside CoPilot.
363
+ - Walks through Docker Compose or service-level deployment changes.
364
+ - Demonstrates alert flow from detection source into CoPilot incident views.
365
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
366
+- Key CoPilot features shown: Wazuh integration, VirusTotal enrichment, Enrichment workflows
367
+
368
+#### CoPilot + VirusTotal: Instantly Scan Files for Malware!
369
+- Link: https://www.youtube.com/watch?v=ixxVe_9LAfQ
370
+- Best for: Both
371
+- What you learn:
372
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
373
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
374
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
375
+ - Shows malware/IoC enrichment flow and how reputation context changes triage decisions.
376
+ - Connects exposure data to prioritization so teams can address the highest-risk items first.
377
+ - Shows connector setup steps and validation inside CoPilot.
378
+ - Uses API-driven actions to push, pull, or validate security operations data.
379
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
380
+- Key CoPilot features shown: VirusTotal enrichment, SCA visibility, Enrichment workflows
381
+
382
+#### CoPilot Supercharges Wazuh with SCA & Vulnerability Overviews
383
+- Link: https://www.youtube.com/watch?v=NUrnlTvLzVk
384
+- Best for: Both
385
+- What you learn:
386
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
387
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
388
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
389
+ - Connects exposure data to prioritization so teams can address the highest-risk items first.
390
+ - Explains how index/search data is selected and mapped for operations.
391
+ - Demonstrates customer-aware workflows and tenant context handling.
392
+ - Shows practical filtering/search techniques for triage speed.
393
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
394
+- Key CoPilot features shown: Wazuh integration, SCA visibility, Vulnerability visibility, Enrichment workflows
395
+
396
+## Admin/Engineer Track (admins / engineers)
397
+
398
+Connecting sources, configuring integrations, tuning detections, reporting, and platform operations.
399
+
400
+### Start Here: Platform Overview and Installation
401
+
402
+#### Copilot - Your Open Source Security Integrator
403
- Link: https://www.youtube.com/watch?v=qQbex2zAhWI
404
- Best for: Admin-Engineer
405
- What you learn:
@@ -16,7 +411,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
411
- Provides a concise end-to-end example that connects configuration, validation, and operational usage.
412
- Key CoPilot features shown: Platform onboarding
413
19
-### Copilot - Your Next Open Source Security Tool
414
+#### Copilot - Your Next Open Source Security Tool
415
- Link: https://www.youtube.com/watch?v=CQolYA30Gls
416
- Best for: Admin-Engineer
417
- What you learn:
@@ -30,7 +425,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
425
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
426
- Key CoPilot features shown: Grafana integration, Shuffle SOAR integration, Platform onboarding
427
33
-### CoPilot Install
428
+#### CoPilot Install
429
- Link: https://www.youtube.com/watch?v=seITDGXAiJw
430
- Best for: Admin-Engineer
431
- What you learn:
@@ -44,7 +439,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
439
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
440
- Key CoPilot features shown: Platform onboarding
441
47
-### CoPilot Install -- Final Update (I Hope)
442
+#### CoPilot Install -- Final Update (I Hope)
443
- Link: https://www.youtube.com/watch?v=7dUHSMWWTuY
444
- Best for: Admin-Engineer
445
- What you learn:
@@ -58,9 +453,9 @@ Use this page as a fast path through the CoPilot video library. Start with the f
453
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
454
- Key CoPilot features shown: Grafana integration, Platform onboarding
455
61
-## Core SOC Workflows: Alerting, Case Management, and Investigations
456
+### Core SOC Workflows: Alerting, Case Management, and Investigations
457
63
-### Wazuh Content Pack For Graylog - Easily Configure Your SOCFortress SIEM Stack
458
+#### Wazuh Content Pack For Graylog - Easily Configure Your SOCFortress SIEM Stack
459
- Link: https://www.youtube.com/watch?v=euFrHP0VkD8
460
- Best for: Both
461
- What you learn:
@@ -74,7 +469,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
469
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
470
- Key CoPilot features shown: Wazuh integration, Graylog connector, Grafana integration, Incident management, Alert triage UI
471
77
-### Wazuh Security Configuration Assessment and CoPilot - Are Your Endpoints Compliant?
472
+#### Wazuh Security Configuration Assessment and CoPilot - Are Your Endpoints Compliant?
473
- Link: https://www.youtube.com/watch?v=ffAnV31Ne54
474
- Best for: Both
475
- What you learn:
@@ -88,35 +483,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
483
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
484
- Key CoPilot features shown: Wazuh integration, SCA visibility, Incident management, Alert triage UI
485
91
-### Powerful Wazuh Alert Management With CoPilot!
92
-- Link: https://www.youtube.com/watch?v=3p6qiH9UF8U
93
-- Best for: Operator
94
-- What you learn:
95
- - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
96
- - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
97
- - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
98
- - Breaks down alert lifecycle handling and practical techniques for reducing analyst overload.
99
- - Shows connector setup steps and validation inside CoPilot.
100
- - Demonstrates alert flow from detection source into CoPilot incident views.
101
- - Explains how index/search data is selected and mapped for operations.
102
- - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
103
-- Key CoPilot features shown: Wazuh integration, Built-in case management, Incident management, Alert triage UI
104
-
105
-### Introducing the Datastore in CoPilot: Upload Artifacts into Cases with Ease
106
-- Link: https://www.youtube.com/watch?v=GwPyKM2X1EM
107
-- Best for: Operator
108
-- What you learn:
109
- - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
110
- - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
111
- - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
112
- - Demonstrates uploading and attaching investigation artifacts directly into cases for evidence continuity.
113
- - Walks through Docker Compose or service-level deployment changes.
114
- - Demonstrates alert flow from detection source into CoPilot incident views.
115
- - Demonstrates customer-aware workflows and tenant context handling.
116
- - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
117
-- Key CoPilot features shown: Case datastore/artifact uploads, Incident management, Alert triage UI
118
-
119
-### Supercharge Open-Source Cybersecurity: Velociraptor + Sigma for Your SIEM
486
+#### Supercharge Open-Source Cybersecurity: Velociraptor + Sigma for Your SIEM
487
- Link: https://www.youtube.com/watch?v=S2ELWusHcxA
488
- Best for: Both
489
- What you learn:
@@ -130,7 +497,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
497
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
498
- Key CoPilot features shown: Velociraptor integration, Sigma rule workflow, SCA visibility, Incident management, Alert triage UI
499
133
-### Manage Wazuh Detection Rules with CoPilot
500
+#### Manage Wazuh Detection Rules with CoPilot
501
- Link: https://www.youtube.com/watch?v=31lCr80-NVM
502
- Best for: Admin-Engineer
503
- What you learn:
@@ -144,7 +511,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
511
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
512
- Key CoPilot features shown: Wazuh integration, Detection rule management, Incident management, Alert triage UI
513
147
-### Open Source SIEM Response | Dynamic Endpoint Actions with SOCFortress CoPilot
514
+#### Open Source SIEM Response | Dynamic Endpoint Actions with SOCFortress CoPilot
515
- Link: https://www.youtube.com/watch?v=l9OLtgemYOQ
516
- Best for: Both
517
- What you learn:
@@ -158,23 +525,9 @@ Use this page as a fast path through the CoPilot video library. Start with the f
525
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
526
- Key CoPilot features shown: Velociraptor integration, Active response automation, Vulnerability visibility, Incident management, Alert triage UI
527
161
-### Endpoint Investigation Made Easier: New Velociraptor Features in SOCFORTRESS CoPilot
162
-- Link: https://www.youtube.com/watch?v=R_pG1Gx_7O8
163
-- Best for: Operator
164
-- What you learn:
165
- - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
166
- - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
167
- - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
168
- - Demonstrates alert flow from detection source into CoPilot incident views.
169
- - Uses API-driven actions to push, pull, or validate security operations data.
170
- - Connects alert context to endpoint/asset details for analyst decision making.
171
- - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
172
- - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
173
-- Key CoPilot features shown: Velociraptor integration, Incident management, Alert triage UI
174
-
175
-## AI Analyst and Assistant Workflows
528
+### AI Analyst and Assistant Workflows
529
177
-### AI Analyst for Wazuh Alerts: Revolutionize Your SOC with SOCFortress Copilot!
530
+#### AI Analyst for Wazuh Alerts: Revolutionize Your SOC with SOCFortress Copilot!
531
- Link: https://www.youtube.com/watch?v=-2srPC-Dw-0
532
- Best for: Both
533
- What you learn:
@@ -188,7 +541,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
541
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
542
- Key CoPilot features shown: Wazuh integration, AI analyst, AI-assisted investigation
543
191
-### AI Agent for Open Source SIEM: Wazuh, Velociraptor + CoPilot!
544
+#### AI Agent for Open Source SIEM: Wazuh, Velociraptor + CoPilot!
545
- Link: https://www.youtube.com/watch?v=FHjD9QBaLD4
546
- Best for: Both
547
- What you learn:
@@ -202,7 +555,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
555
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
556
- Key CoPilot features shown: Wazuh integration, Velociraptor integration, AI agent, AI-assisted investigation
557
205
-### AI Chatbot Now With Threat Intel, Cyber News, Knowledge Base & Attack Surface!
558
+#### AI Chatbot Now With Threat Intel, Cyber News, Knowledge Base & Attack Surface!
559
- Link: https://www.youtube.com/watch?v=QaLrmSgEcLI
560
- Best for: Both
561
- What you learn:
@@ -216,9 +569,9 @@ Use this page as a fast path through the CoPilot video library. Start with the f
569
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
570
- Key CoPilot features shown: Velociraptor integration, AI chatbot, AI-assisted investigation
571
219
-## Detection Engineering and Response Automation
572
+### Detection Engineering and Response Automation
573
221
-### Automate Your SOC: Triggering Alerts with Wazuh Rules via Copilot
574
+#### Automate Your SOC: Triggering Alerts with Wazuh Rules via Copilot
575
- Link: https://www.youtube.com/watch?v=tguRiVgytso
576
- Best for: Both
577
- What you learn:
@@ -232,7 +585,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
585
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
586
- Key CoPilot features shown: Wazuh integration, Detection tuning
587
235
-### Wazuh Rule Writing With CoPilot AI Module - Handle Your Alert Flooding
588
+#### Wazuh Rule Writing With CoPilot AI Module - Handle Your Alert Flooding
589
- Link: https://www.youtube.com/watch?v=AH1g3p8s2_o
590
- Best for: Both
591
- What you learn:
@@ -246,7 +599,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
599
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
600
- Key CoPilot features shown: Wazuh integration, Detection tuning
601
249
-### Mastering Wazuh's Active Response: Block Malicious IPs with CoPilot & Wazuh!
602
+#### Mastering Wazuh's Active Response: Block Malicious IPs with CoPilot & Wazuh!
603
- Link: https://www.youtube.com/watch?v=llm3uSSUhqs
604
- Best for: Both
605
- What you learn:
@@ -260,7 +613,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
613
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
614
- Key CoPilot features shown: Wazuh integration, Active response automation, Detection tuning
615
263
-### Revolutionize Your SIEM Alerts: Integrate CoPilot & Shuffle
616
+#### Revolutionize Your SIEM Alerts: Integrate CoPilot & Shuffle
617
- Link: https://www.youtube.com/watch?v=Ko5jLfkSCrk
618
- Best for: Both
619
- What you learn:
@@ -274,7 +627,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
627
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
628
- Key CoPilot features shown: Shuffle SOAR integration, Detection tuning
629
277
-### Tame the Noise: Sigma Exclusions in CoPilot for Velociraptor Alerts
630
+#### Tame the Noise: Sigma Exclusions in CoPilot for Velociraptor Alerts
631
- Link: https://www.youtube.com/watch?v=GWTNA-6Z_Tk
632
- Best for: Both
633
- What you learn:
@@ -288,7 +641,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
641
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
642
- Key CoPilot features shown: Velociraptor integration, Sigma rule workflow, Sysmon config management, Detection tuning
643
291
-### 🚀 Master Sysmon Config Management with CoPilot & Wazuh!
644
+#### 🚀 Master Sysmon Config Management with CoPilot & Wazuh!
645
- Link: https://www.youtube.com/watch?v=XT1d49HTqQw
646
- Best for: Both
647
- What you learn:
@@ -302,7 +655,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
655
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
656
- Key CoPilot features shown: Wazuh integration, Sysmon config management, Detection tuning
657
305
-### Supercharge Wazuh Active Response with CoPilot: No More Limits!
658
+#### Supercharge Wazuh Active Response with CoPilot: No More Limits!
659
- Link: https://www.youtube.com/watch?v=Ogr70DWAeTc
660
- Best for: Both
661
- What you learn:
@@ -316,7 +669,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
669
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
670
- Key CoPilot features shown: Wazuh integration, Active response automation, Detection tuning
671
319
-### Test Your Wazuh Detection Rules: One-Click Atomic Red Team + Velociraptor + CoPilot
672
+#### Test Your Wazuh Detection Rules: One-Click Atomic Red Team + Velociraptor + CoPilot
673
- Link: https://www.youtube.com/watch?v=TMJOBATTK9M
674
- Best for: Both
675
- What you learn:
@@ -330,7 +683,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
683
- Shows practical filtering/search techniques for triage speed.
684
- Key CoPilot features shown: Wazuh integration, Velociraptor integration, Atomic Red Team testing, Detection rule management, Detection tuning
685
333
-### Simulate Linux Attacks and Tune Detection Rules with Atomic Red Team
686
+#### Simulate Linux Attacks and Tune Detection Rules with Atomic Red Team
687
- Link: https://www.youtube.com/watch?v=tL3oNEx_3M8
688
- Best for: Both
689
- What you learn:
@@ -344,9 +697,9 @@ Use this page as a fast path through the CoPilot video library. Start with the f
697
- Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
698
- Key CoPilot features shown: Atomic Red Team testing, Detection rule management, Detection tuning
699
347
-## Integrations and Log Ingestion
700
+### Integrations and Log Ingestion
701
349
-### Wazuh Indexer and CoPilot Integration
702
+#### Wazuh Indexer and CoPilot Integration
703
- Link: https://www.youtube.com/watch?v=MKqByrkDqZU
704
- Best for: Admin-Engineer
705
- What you learn:
@@ -360,7 +713,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
713
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
714
- Key CoPilot features shown: Wazuh integration, Connector onboarding
715
363
-### Graylog and CoPilot Integration
716
+#### Graylog and CoPilot Integration
717
- Link: https://www.youtube.com/watch?v=MyvPmQ4Cfb0
718
- Best for: Admin-Engineer
719
- What you learn:
@@ -374,7 +727,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
727
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
728
- Key CoPilot features shown: Graylog connector, Connector onboarding
729
377
-### Wazuh Manager and CoPilot Integration
730
+#### Wazuh Manager and CoPilot Integration
731
- Link: https://www.youtube.com/watch?v=iI6yKgKC5wk
732
- Best for: Admin-Engineer
733
- What you learn:
@@ -387,7 +740,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
740
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
741
- Key CoPilot features shown: Wazuh integration, Connector onboarding
742
390
-### Velociraptor and Copilot Integration
743
+#### Velociraptor and Copilot Integration
744
- Link: https://www.youtube.com/watch?v=-Cqyczg6ELE
745
- Best for: Admin-Engineer
746
- What you learn:
@@ -400,7 +753,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
753
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
754
- Key CoPilot features shown: Velociraptor integration, Connector onboarding
755
403
-### CoPilot And InfluxDB - Monitor Your SIEM Stack Servers with InfluxDB and CoPilot!
756
+#### CoPilot And InfluxDB - Monitor Your SIEM Stack Servers with InfluxDB and CoPilot!
757
- Link: https://www.youtube.com/watch?v=vt6M1SzNfjE
758
- Best for: Admin-Engineer
759
- What you learn:
@@ -414,7 +767,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
767
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
768
- Key CoPilot features shown: Grafana integration, InfluxDB metrics integration, Connector onboarding
769
417
-### DFIR-IRIS and CoPilot - Bring your SOC Alerts into CoPilot
770
+#### DFIR-IRIS and CoPilot - Bring your SOC Alerts into CoPilot
771
- Link: https://www.youtube.com/watch?v=n9koQ1UL-L0
772
- Best for: Admin-Engineer
773
- What you learn:
@@ -428,7 +781,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
781
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
782
- Key CoPilot features shown: Built-in case management, SCA visibility, Connector onboarding
783
431
-### Grafana and CoPilot Integration
784
+#### Grafana and CoPilot Integration
785
- Link: https://www.youtube.com/watch?v=FOOU1PQnd7g
786
- Best for: Admin-Engineer
787
- What you learn:
@@ -441,7 +794,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
794
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
795
- Key CoPilot features shown: Grafana integration, Connector onboarding
796
444
-### Seamless Office365 Integration with Wazuh: Simplified by Copilot
797
+#### Seamless Office365 Integration with Wazuh: Simplified by Copilot
798
- Link: https://www.youtube.com/watch?v=ihj2F2rA6BQ
799
- Best for: Admin-Engineer
800
- What you learn:
@@ -455,7 +808,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
808
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
809
- Key CoPilot features shown: Wazuh integration, Office 365 connector, Connector onboarding
810
458
-### Unlock Full SIEM Potential: Effortlessly Ingest Crowdstrike Events Into Your Open Source SIEM!
811
+#### Unlock Full SIEM Potential: Effortlessly Ingest Crowdstrike Events Into Your Open Source SIEM!
812
- Link: https://www.youtube.com/watch?v=YOVUOpZDEzM
813
- Best for: Admin-Engineer
814
- What you learn:
@@ -469,7 +822,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
822
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
823
- Key CoPilot features shown: CrowdStrike ingestion, Customer portal, Connector onboarding
824
472
-### CoPilot Event Shipper Configuration - Ingest 3rd Party Logs into your SIEM Stack
825
+#### CoPilot Event Shipper Configuration - Ingest 3rd Party Logs into your SIEM Stack
826
- Link: https://www.youtube.com/watch?v=tgWRvOJX5HA
827
- Best for: Admin-Engineer
828
- What you learn:
@@ -482,7 +835,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
835
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
836
- Key CoPilot features shown: DUO MFA ingestion, Event shipper, Connector onboarding
837
485
-### Unlock Full SIEM Potential: Effortlessly Ingest DUO MFA Events Into Your Open Source SIEM!
838
+#### Unlock Full SIEM Potential: Effortlessly Ingest DUO MFA Events Into Your Open Source SIEM!
839
- Link: https://www.youtube.com/watch?v=chTthkpMpTY
840
- Best for: Admin-Engineer
841
- What you learn:
@@ -496,7 +849,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
849
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
850
- Key CoPilot features shown: DUO MFA ingestion, Event shipper, Connector onboarding
851
499
-### New MITRE ATT&CK Integration in CoPilot – Game Changer for SOC Analysts!
852
+#### New MITRE ATT&CK Integration in CoPilot – Game Changer for SOC Analysts!
853
- Link: https://www.youtube.com/watch?v=wK4aA7QrXmE
854
- Best for: Admin-Engineer
855
- What you learn:
@@ -510,7 +863,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
863
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
864
- Key CoPilot features shown: MITRE ATT&CK mapping, Connector onboarding
865
513
-### Supercharge Your Log Ingestion: Webhooks to SIEM Made Easy
866
+#### Supercharge Your Log Ingestion: Webhooks to SIEM Made Easy
867
- Link: https://www.youtube.com/watch?v=O5SaFwAMMtA
868
- Best for: Admin-Engineer
869
- What you learn:
@@ -524,9 +877,9 @@ Use this page as a fast path through the CoPilot video library. Start with the f
877
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
878
- Key CoPilot features shown: Webhook ingestion pipeline, Shuffle SOAR integration, Connector onboarding
879
527
-## Threat Intelligence, Vulnerability, and Security Posture
880
+### Threat Intelligence, Vulnerability, and Security Posture
881
529
-### Auto-Enrich Wazuh Events with Threat Intel Feeds!
882
+#### Auto-Enrich Wazuh Events with Threat Intel Feeds!
883
- Link: https://www.youtube.com/watch?v=FJunzP2c_mQ
884
- Best for: Both
885
- What you learn:
@@ -540,7 +893,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
893
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
894
- Key CoPilot features shown: Wazuh integration, Enrichment workflows
895
543
-### Analyzing Processes in Wazuh Alerts with Advanced Risk Scoring from Global Data
896
+#### Analyzing Processes in Wazuh Alerts with Advanced Risk Scoring from Global Data
897
- Link: https://www.youtube.com/watch?v=CVVj9HRtjOE
898
- Best for: Both
899
- What you learn:
@@ -553,7 +906,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
906
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
907
- Key CoPilot features shown: Wazuh integration, Enrichment workflows
908
556
-### Simplify Cloud Security: ScoutSuite and Copilot Tutorial
909
+#### Simplify Cloud Security: ScoutSuite and Copilot Tutorial
910
- Link: https://www.youtube.com/watch?v=G3MDJSMvnRo
911
- Best for: Both
912
- What you learn:
@@ -566,7 +919,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
919
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
920
- Key CoPilot features shown: SCA visibility, Enrichment workflows
921
569
-### Integrate EPSS with Wazuh for Top-Notch Vulnerability Management!
922
+#### Integrate EPSS with Wazuh for Top-Notch Vulnerability Management!
923
- Link: https://www.youtube.com/watch?v=Qnm9SXVJGWw
924
- Best for: Both
925
- What you learn:
@@ -578,7 +931,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
931
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
932
- Key CoPilot features shown: Wazuh integration, EPSS enrichment, Vulnerability visibility, Enrichment workflows
933
581
-### Enhancing Web App Security: Integrating Copilot with Nuclei for Vulnerability Scanning
934
+#### Enhancing Web App Security: Integrating Copilot with Nuclei for Vulnerability Scanning
935
- Link: https://www.youtube.com/watch?v=-SVHKuQUxlI
936
- Best for: Both
937
- What you learn:
@@ -592,7 +945,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
945
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
946
- Key CoPilot features shown: DUO MFA ingestion, Nuclei scanning integration, SCA visibility, Vulnerability visibility, Enrichment workflows
947
595
-### Boost CoPilot: IoCs from Wazuh + VirusTotal Enrichment
948
+#### Boost CoPilot: IoCs from Wazuh + VirusTotal Enrichment
949
- Link: https://www.youtube.com/watch?v=fNybop2FTRE
950
- Best for: Both
951
- What you learn:
@@ -606,7 +959,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
959
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
960
- Key CoPilot features shown: Wazuh integration, VirusTotal enrichment, Enrichment workflows
961
609
-### CoPilot + VirusTotal: Instantly Scan Files for Malware!
962
+#### CoPilot + VirusTotal: Instantly Scan Files for Malware!
963
- Link: https://www.youtube.com/watch?v=ixxVe_9LAfQ
964
- Best for: Both
965
- What you learn:
@@ -620,7 +973,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
973
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
974
- Key CoPilot features shown: VirusTotal enrichment, SCA visibility, Enrichment workflows
975
623
-### CoPilot Supercharges Wazuh with SCA & Vulnerability Overviews
976
+#### CoPilot Supercharges Wazuh with SCA & Vulnerability Overviews
977
- Link: https://www.youtube.com/watch?v=NUrnlTvLzVk
978
- Best for: Both
979
- What you learn:
@@ -634,9 +987,9 @@ Use this page as a fast path through the CoPilot video library. Start with the f
987
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
988
- Key CoPilot features shown: Wazuh integration, SCA visibility, Vulnerability visibility, Enrichment workflows
989
637
-## Operations, Reporting, and Customer Experience
990
+### Operations, Reporting, and Customer Experience
991
639
-### Wazuh Dashboards in Grafana & Customer Provisioning in CoPilot!
992
+#### Wazuh Dashboards in Grafana & Customer Provisioning in CoPilot!
993
- Link: https://www.youtube.com/watch?v=hC0JHY5WF-U
994
- Best for: Admin-Engineer
995
- What you learn:
@@ -650,7 +1003,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
1003
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
1004
- Key CoPilot features shown: Wazuh integration, Grafana integration, Multi-tenant operations
1005
653
-### Create Custom PDF Reports in Grafana Detailing Security Events | Share with Your Clients!
1006
+#### Create Custom PDF Reports in Grafana Detailing Security Events | Share with Your Clients!
1007
- Link: https://www.youtube.com/watch?v=9xHr5-Wlypw
1008
- Best for: Admin-Engineer
1009
- What you learn:
@@ -664,7 +1017,7 @@ Use this page as a fast path through the CoPilot video library. Start with the f
1017
- Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
1018
- Key CoPilot features shown: Grafana integration, Reporting workflow, Multi-tenant operations
1019
667
-### A Customer Portal for Your Open-Source SIEM Stack
1020
+#### A Customer Portal for Your Open-Source SIEM Stack
1021
- Link: https://www.youtube.com/watch?v=_bvFejcFwFM
1022
- Best for: Admin-Engineer
1023
- What you learn:
@@ -678,53 +1031,53 @@ Use this page as a fast path through the CoPilot video library. Start with the f
1031
- Includes practical walkthrough steps that can be replicated in production-like SOC environments.
1032
- Key CoPilot features shown: Customer portal, Multi-tenant operations
1033
681
-## Index
682
-
683
-- [Copilot - Your Open Source Security Integrator](https://www.youtube.com/watch?v=qQbex2zAhWI)
684
-- [Copilot - Your Next Open Source Security Tool](https://www.youtube.com/watch?v=CQolYA30Gls)
685
-- [CoPilot Install](https://www.youtube.com/watch?v=seITDGXAiJw)
686
-- [CoPilot Install -- Final Update (I Hope)](https://www.youtube.com/watch?v=7dUHSMWWTuY)
687
-- [Wazuh Content Pack For Graylog - Easily Configure Your SOCFortress SIEM Stack](https://www.youtube.com/watch?v=euFrHP0VkD8)
688
-- [Wazuh Security Configuration Assessment and CoPilot - Are Your Endpoints Compliant?](https://www.youtube.com/watch?v=ffAnV31Ne54)
689
-- [Powerful Wazuh Alert Management With CoPilot!](https://www.youtube.com/watch?v=3p6qiH9UF8U)
690
-- [Introducing the Datastore in CoPilot: Upload Artifacts into Cases with Ease](https://www.youtube.com/watch?v=GwPyKM2X1EM)
691
-- [Supercharge Open-Source Cybersecurity: Velociraptor + Sigma for Your SIEM](https://www.youtube.com/watch?v=S2ELWusHcxA)
692
-- [Manage Wazuh Detection Rules with CoPilot](https://www.youtube.com/watch?v=31lCr80-NVM)
693
-- [Open Source SIEM Response | Dynamic Endpoint Actions with SOCFortress CoPilot](https://www.youtube.com/watch?v=l9OLtgemYOQ)
694
-- [Endpoint Investigation Made Easier: New Velociraptor Features in SOCFORTRESS CoPilot](https://www.youtube.com/watch?v=R_pG1Gx_7O8)
695
-- [AI Analyst for Wazuh Alerts: Revolutionize Your SOC with SOCFortress Copilot!](https://www.youtube.com/watch?v=-2srPC-Dw-0)
696
-- [AI Agent for Open Source SIEM: Wazuh, Velociraptor + CoPilot!](https://www.youtube.com/watch?v=FHjD9QBaLD4)
697
-- [AI Chatbot Now With Threat Intel, Cyber News, Knowledge Base & Attack Surface!](https://www.youtube.com/watch?v=QaLrmSgEcLI)
698
-- [Automate Your SOC: Triggering Alerts with Wazuh Rules via Copilot](https://www.youtube.com/watch?v=tguRiVgytso)
699
-- [Wazuh Rule Writing With CoPilot AI Module - Handle Your Alert Flooding](https://www.youtube.com/watch?v=AH1g3p8s2_o)
700
-- [Mastering Wazuh's Active Response: Block Malicious IPs with CoPilot & Wazuh!](https://www.youtube.com/watch?v=llm3uSSUhqs)
701
-- [Revolutionize Your SIEM Alerts: Integrate CoPilot & Shuffle](https://www.youtube.com/watch?v=Ko5jLfkSCrk)
702
-- [Tame the Noise: Sigma Exclusions in CoPilot for Velociraptor Alerts](https://www.youtube.com/watch?v=GWTNA-6Z_Tk)
703
-- [🚀 Master Sysmon Config Management with CoPilot & Wazuh!](https://www.youtube.com/watch?v=XT1d49HTqQw)
704
-- [Supercharge Wazuh Active Response with CoPilot: No More Limits!](https://www.youtube.com/watch?v=Ogr70DWAeTc)
705
-- [Test Your Wazuh Detection Rules: One-Click Atomic Red Team + Velociraptor + CoPilot](https://www.youtube.com/watch?v=TMJOBATTK9M)
706
-- [Simulate Linux Attacks and Tune Detection Rules with Atomic Red Team](https://www.youtube.com/watch?v=tL3oNEx_3M8)
707
-- [Wazuh Indexer and CoPilot Integration](https://www.youtube.com/watch?v=MKqByrkDqZU)
708
-- [Graylog and CoPilot Integration](https://www.youtube.com/watch?v=MyvPmQ4Cfb0)
709
-- [Wazuh Manager and CoPilot Integration](https://www.youtube.com/watch?v=iI6yKgKC5wk)
710
-- [Velociraptor and Copilot Integration](https://www.youtube.com/watch?v=-Cqyczg6ELE)
711
-- [CoPilot And InfluxDB - Monitor Your SIEM Stack Servers with InfluxDB and CoPilot!](https://www.youtube.com/watch?v=vt6M1SzNfjE)
712
-- [DFIR-IRIS and CoPilot - Bring your SOC Alerts into CoPilot](https://www.youtube.com/watch?v=n9koQ1UL-L0)
713
-- [Grafana and CoPilot Integration](https://www.youtube.com/watch?v=FOOU1PQnd7g)
714
-- [Seamless Office365 Integration with Wazuh: Simplified by Copilot](https://www.youtube.com/watch?v=ihj2F2rA6BQ)
715
-- [Unlock Full SIEM Potential: Effortlessly Ingest Crowdstrike Events Into Your Open Source SIEM!](https://www.youtube.com/watch?v=YOVUOpZDEzM)
716
-- [CoPilot Event Shipper Configuration - Ingest 3rd Party Logs into your SIEM Stack](https://www.youtube.com/watch?v=tgWRvOJX5HA)
717
-- [Unlock Full SIEM Potential: Effortlessly Ingest DUO MFA Events Into Your Open Source SIEM!](https://www.youtube.com/watch?v=chTthkpMpTY)
718
-- [New MITRE ATT&CK Integration in CoPilot – Game Changer for SOC Analysts!](https://www.youtube.com/watch?v=wK4aA7QrXmE)
719
-- [Supercharge Your Log Ingestion: Webhooks to SIEM Made Easy](https://www.youtube.com/watch?v=O5SaFwAMMtA)
720
-- [Auto-Enrich Wazuh Events with Threat Intel Feeds!](https://www.youtube.com/watch?v=FJunzP2c_mQ)
721
-- [Analyzing Processes in Wazuh Alerts with Advanced Risk Scoring from Global Data](https://www.youtube.com/watch?v=CVVj9HRtjOE)
722
-- [Simplify Cloud Security: ScoutSuite and Copilot Tutorial](https://www.youtube.com/watch?v=G3MDJSMvnRo)
723
-- [Integrate EPSS with Wazuh for Top-Notch Vulnerability Management!](https://www.youtube.com/watch?v=Qnm9SXVJGWw)
724
-- [Enhancing Web App Security: Integrating Copilot with Nuclei for Vulnerability Scanning](https://www.youtube.com/watch?v=-SVHKuQUxlI)
725
-- [Boost CoPilot: IoCs from Wazuh + VirusTotal Enrichment](https://www.youtube.com/watch?v=fNybop2FTRE)
726
-- [CoPilot + VirusTotal: Instantly Scan Files for Malware!](https://www.youtube.com/watch?v=ixxVe_9LAfQ)
727
-- [CoPilot Supercharges Wazuh with SCA & Vulnerability Overviews](https://www.youtube.com/watch?v=NUrnlTvLzVk)
728
-- [Wazuh Dashboards in Grafana & Customer Provisioning in CoPilot!](https://www.youtube.com/watch?v=hC0JHY5WF-U)
729
-- [Create Custom PDF Reports in Grafana Detailing Security Events | Share with Your Clients!](https://www.youtube.com/watch?v=9xHr5-Wlypw)
730
-- [A Customer Portal for Your Open-Source SIEM Stack](https://www.youtube.com/watch?v=_bvFejcFwFM)
1034
+## Index (all videos)
1035
+
1036
+- [Copilot - Your Open Source Security Integrator](https://www.youtube.com/watch?v=qQbex2zAhWI) — *Best for: Admin-Engineer*
1037
+- [Copilot - Your Next Open Source Security Tool](https://www.youtube.com/watch?v=CQolYA30Gls) — *Best for: Admin-Engineer*
1038
+- [CoPilot Install](https://www.youtube.com/watch?v=seITDGXAiJw) — *Best for: Admin-Engineer*
1039
+- [CoPilot Install -- Final Update (I Hope)](https://www.youtube.com/watch?v=7dUHSMWWTuY) — *Best for: Admin-Engineer*
1040
+- [Wazuh Content Pack For Graylog - Easily Configure Your SOCFortress SIEM Stack](https://www.youtube.com/watch?v=euFrHP0VkD8) — *Best for: Both*
1041
+- [Wazuh Security Configuration Assessment and CoPilot - Are Your Endpoints Compliant?](https://www.youtube.com/watch?v=ffAnV31Ne54) — *Best for: Both*
1042
+- [Powerful Wazuh Alert Management With CoPilot!](https://www.youtube.com/watch?v=3p6qiH9UF8U) — *Best for: Operator*
1043
+- [Introducing the Datastore in CoPilot: Upload Artifacts into Cases with Ease](https://www.youtube.com/watch?v=GwPyKM2X1EM) — *Best for: Operator*
1044
+- [Supercharge Open-Source Cybersecurity: Velociraptor + Sigma for Your SIEM](https://www.youtube.com/watch?v=S2ELWusHcxA) — *Best for: Both*
1045
+- [Manage Wazuh Detection Rules with CoPilot](https://www.youtube.com/watch?v=31lCr80-NVM) — *Best for: Admin-Engineer*
1046
+- [Open Source SIEM Response | Dynamic Endpoint Actions with SOCFortress CoPilot](https://www.youtube.com/watch?v=l9OLtgemYOQ) — *Best for: Both*
1047
+- [Endpoint Investigation Made Easier: New Velociraptor Features in SOCFORTRESS CoPilot](https://www.youtube.com/watch?v=R_pG1Gx_7O8) — *Best for: Operator*
1048
+- [AI Analyst for Wazuh Alerts: Revolutionize Your SOC with SOCFortress Copilot!](https://www.youtube.com/watch?v=-2srPC-Dw-0) — *Best for: Both*
1049
+- [AI Agent for Open Source SIEM: Wazuh, Velociraptor + CoPilot!](https://www.youtube.com/watch?v=FHjD9QBaLD4) — *Best for: Both*
1050
+- [AI Chatbot Now With Threat Intel, Cyber News, Knowledge Base & Attack Surface!](https://www.youtube.com/watch?v=QaLrmSgEcLI) — *Best for: Both*
1051
+- [Automate Your SOC: Triggering Alerts with Wazuh Rules via Copilot](https://www.youtube.com/watch?v=tguRiVgytso) — *Best for: Both*
1052
+- [Wazuh Rule Writing With CoPilot AI Module - Handle Your Alert Flooding](https://www.youtube.com/watch?v=AH1g3p8s2_o) — *Best for: Both*
1053
+- [Mastering Wazuh's Active Response: Block Malicious IPs with CoPilot & Wazuh!](https://www.youtube.com/watch?v=llm3uSSUhqs) — *Best for: Both*
1054
+- [Revolutionize Your SIEM Alerts: Integrate CoPilot & Shuffle](https://www.youtube.com/watch?v=Ko5jLfkSCrk) — *Best for: Both*
1055
+- [Tame the Noise: Sigma Exclusions in CoPilot for Velociraptor Alerts](https://www.youtube.com/watch?v=GWTNA-6Z_Tk) — *Best for: Both*
1056
+- [🚀 Master Sysmon Config Management with CoPilot & Wazuh!](https://www.youtube.com/watch?v=XT1d49HTqQw) — *Best for: Both*
1057
+- [Supercharge Wazuh Active Response with CoPilot: No More Limits!](https://www.youtube.com/watch?v=Ogr70DWAeTc) — *Best for: Both*
1058
+- [Test Your Wazuh Detection Rules: One-Click Atomic Red Team + Velociraptor + CoPilot](https://www.youtube.com/watch?v=TMJOBATTK9M) — *Best for: Both*
1059
+- [Simulate Linux Attacks and Tune Detection Rules with Atomic Red Team](https://www.youtube.com/watch?v=tL3oNEx_3M8) — *Best for: Both*
1060
+- [Wazuh Indexer and CoPilot Integration](https://www.youtube.com/watch?v=MKqByrkDqZU) — *Best for: Admin-Engineer*
1061
+- [Graylog and CoPilot Integration](https://www.youtube.com/watch?v=MyvPmQ4Cfb0) — *Best for: Admin-Engineer*
1062
+- [Wazuh Manager and CoPilot Integration](https://www.youtube.com/watch?v=iI6yKgKC5wk) — *Best for: Admin-Engineer*
1063
+- [Velociraptor and Copilot Integration](https://www.youtube.com/watch?v=-Cqyczg6ELE) — *Best for: Admin-Engineer*
1064
+- [CoPilot And InfluxDB - Monitor Your SIEM Stack Servers with InfluxDB and CoPilot!](https://www.youtube.com/watch?v=vt6M1SzNfjE) — *Best for: Admin-Engineer*
1065
+- [DFIR-IRIS and CoPilot - Bring your SOC Alerts into CoPilot](https://www.youtube.com/watch?v=n9koQ1UL-L0) — *Best for: Admin-Engineer*
1066
+- [Grafana and CoPilot Integration](https://www.youtube.com/watch?v=FOOU1PQnd7g) — *Best for: Admin-Engineer*
1067
+- [Seamless Office365 Integration with Wazuh: Simplified by Copilot](https://www.youtube.com/watch?v=ihj2F2rA6BQ) — *Best for: Admin-Engineer*
1068
+- [Unlock Full SIEM Potential: Effortlessly Ingest Crowdstrike Events Into Your Open Source SIEM!](https://www.youtube.com/watch?v=YOVUOpZDEzM) — *Best for: Admin-Engineer*
1069
+- [CoPilot Event Shipper Configuration - Ingest 3rd Party Logs into your SIEM Stack](https://www.youtube.com/watch?v=tgWRvOJX5HA) — *Best for: Admin-Engineer*
1070
+- [Unlock Full SIEM Potential: Effortlessly Ingest DUO MFA Events Into Your Open Source SIEM!](https://www.youtube.com/watch?v=chTthkpMpTY) — *Best for: Admin-Engineer*
1071
+- [New MITRE ATT&CK Integration in CoPilot – Game Changer for SOC Analysts!](https://www.youtube.com/watch?v=wK4aA7QrXmE) — *Best for: Admin-Engineer*
1072
+- [Supercharge Your Log Ingestion: Webhooks to SIEM Made Easy](https://www.youtube.com/watch?v=O5SaFwAMMtA) — *Best for: Admin-Engineer*
1073
+- [Auto-Enrich Wazuh Events with Threat Intel Feeds!](https://www.youtube.com/watch?v=FJunzP2c_mQ) — *Best for: Both*
1074
+- [Analyzing Processes in Wazuh Alerts with Advanced Risk Scoring from Global Data](https://www.youtube.com/watch?v=CVVj9HRtjOE) — *Best for: Both*
1075
+- [Simplify Cloud Security: ScoutSuite and Copilot Tutorial](https://www.youtube.com/watch?v=G3MDJSMvnRo) — *Best for: Both*
1076
+- [Integrate EPSS with Wazuh for Top-Notch Vulnerability Management!](https://www.youtube.com/watch?v=Qnm9SXVJGWw) — *Best for: Both*
1077
+- [Enhancing Web App Security: Integrating Copilot with Nuclei for Vulnerability Scanning](https://www.youtube.com/watch?v=-SVHKuQUxlI) — *Best for: Both*
1078
+- [Boost CoPilot: IoCs from Wazuh + VirusTotal Enrichment](https://www.youtube.com/watch?v=fNybop2FTRE) — *Best for: Both*
1079
+- [CoPilot + VirusTotal: Instantly Scan Files for Malware!](https://www.youtube.com/watch?v=ixxVe_9LAfQ) — *Best for: Both*
1080
+- [CoPilot Supercharges Wazuh with SCA & Vulnerability Overviews](https://www.youtube.com/watch?v=NUrnlTvLzVk) — *Best for: Both*
1081
+- [Wazuh Dashboards in Grafana & Customer Provisioning in CoPilot!](https://www.youtube.com/watch?v=hC0JHY5WF-U) — *Best for: Admin-Engineer*
1082
+- [Create Custom PDF Reports in Grafana Detailing Security Events | Share with Your Clients!](https://www.youtube.com/watch?v=9xHr5-Wlypw) — *Best for: Admin-Engineer*
1083
+- [A Customer Portal for Your Open-Source SIEM Stack](https://www.youtube.com/watch?v=_bvFejcFwFM) — *Best for: Admin-Engineer*