docs: add MkDocs user guide + GitHub Pages scaffold (#694)
* docs: add MkDocs user guide scaffold and GitHub Pages workflow * docs: add structured video guide summaries --------- Co-authored-by: Clawdbot <clawdbot@Clawdbots-Mac-mini.local>
taylorcopilot committed
Feb 14, 2026 at 10:45 UTC
cb6ff03911a88a56df4161f72e3ec19c8ea0520b
8 files changed
+932
.github/workflows/docs-pages.yml
new
+50
@@ -0,0 +1,50 @@
1
+name: Docs (GitHub Pages)
2
+
3
+on:
4
+ push:
5
+ branches: [ main ]
6
+ workflow_dispatch:
7
+
8
+permissions:
9
+ contents: read
10
+ pages: write
11
+ id-token: write
12
+
13
+concurrency:
14
+ group: "pages"
15
+ cancel-in-progress: false
16
+
17
+jobs:
18
+ build:
19
+ runs-on: ubuntu-latest
20
+ steps:
21
+ - uses: actions/checkout@v4
22
+
23
+ - name: Set up Python
24
+ uses: actions/setup-python@v5
25
+ with:
26
+ python-version: '3.11'
27
+
28
+ - name: Install MkDocs Material
29
+ run: |
30
+ python -m pip install --upgrade pip
31
+ pip install mkdocs-material
32
+
33
+ - name: Build site
34
+ run: mkdocs build --strict
35
+
36
+ - name: Upload artifact
37
+ uses: actions/upload-pages-artifact@v3
38
+ with:
39
+ path: site
40
+
41
+ deploy:
42
+ environment:
43
+ name: github-pages
44
+ url: ${{ steps.deployment.outputs.page_url }}
45
+ runs-on: ubuntu-latest
46
+ needs: build
47
+ steps:
48
+ - name: Deploy to GitHub Pages
49
+ id: deployment
50
+ uses: actions/deploy-pages@v4
docs/index.md
new
+12
@@ -0,0 +1,12 @@
1
+# SOCFortress CoPilot Documentation
2
+
3
+This site contains two documentation tracks:
4
+
5
+- **User Guide**: How to use CoPilot day-to-day (SOC operators) and how to configure sources/integrations (admins/engineers).
6
+- **Developer / AI Agent Docs**: Architecture, data flows, schema, and extension playbooks for making safe changes.
7
+
8
+## Start here
9
+
10
+- If you are an **operator/analyst**: start with **User Guide → Quickstart (Operators)**.
11
+- If you are an **admin/engineer**: start with **User Guide → Quickstart (Admins/Engineers)**.
12
+- If you are making changes to the codebase: start with **Developer / AI Agent Docs → Start Here**.
docs/user/admins-quickstart.md
new
+24
@@ -0,0 +1,24 @@
1
+# Quickstart (Admins / Engineers)
2
+
3
+## Where you spend most of your time
4
+
5
+- **Connectors**: configure connectivity to the toolchain (Wazuh, Graylog, Grafana, Velociraptor, etc.).
6
+- **External Services / Integrations**: configure per-customer integrations.
7
+- **Scheduler**: enable/disable and tune background jobs/collectors.
8
+
9
+## Core workflows
10
+
11
+### 1) Configure connectors
12
+- Add URLs / credentials
13
+- Verify connectivity
14
+
15
+### 2) Validate SIEM data availability
16
+- Confirm Wazuh Indexer is reachable
17
+- Confirm Graylog alerts are being written (often `gl-events*`)
18
+
19
+### 3) Provision customer resources (if applicable)
20
+- Use customer provisioning flows for Grafana/Graylog/Wazuh/Portainer where supported
21
+
22
+### 4) Operationalize automation
23
+- Enable scheduled collectors
24
+- Confirm job metadata updates and error handling
docs/user/features.md
new
+27
@@ -0,0 +1,27 @@
1
+# Features by Area
2
+
3
+This page is intended to make “hidden” features discoverable.
4
+
5
+## Incident Management (operators)
6
+- Alerts: triage, tagging, assignment, escalation
7
+- Cases: create, link alerts, close lifecycle
8
+- Comments: alert comments and case comments
9
+- IoCs: attach IoCs to alerts
10
+- Artifacts / datastores: case evidence files and report templates
11
+
12
+## SIEM / Data (operators + engineers)
13
+- Wazuh Indexer search-backed views (CoPilot often pivots using `index_name` + `index_id`)
14
+- Graylog alerting events (commonly `gl-events*`)
15
+
16
+## Integrations / Connectors (engineers)
17
+- Connectors: configure and verify tool connectivity
18
+- Network connectors: customer-scoped connector configs/keys
19
+- Integration settings: customer integration configuration
20
+
21
+## Reporting
22
+- Grafana reporting and PDF generation
23
+- Case report templates
24
+
25
+## Automation
26
+- Scheduler jobs (collectors, sync, alert creation)
27
+- Active response (where enabled)
docs/user/operators-quickstart.md
new
+29
@@ -0,0 +1,29 @@
1
+# Quickstart (SOC Operators)
2
+
3
+## Where you spend most of your time
4
+
5
+- **Incident Management → Alerts**: triage, investigate, and decide next actions.
6
+- **Incident Management → Cases**: manage the lifecycle of incidents.
7
+
8
+## Core workflows
9
+
10
+### 1) Triage an alert
11
+- Open alert details
12
+- Review assets/context
13
+- Add tags (use your tagging taxonomy)
14
+- Add comments and assign if needed
15
+
16
+### 2) Create and link a case
17
+- Create a case from the alert when it needs tracking
18
+- Link related alerts to the same case
19
+
20
+### 3) Attach evidence (artifacts)
21
+- Upload case artifacts (files, exports)
22
+- Use report templates when generating customer-ready PDFs
23
+
24
+### 4) Use SIEM search context
25
+- When an alert references `index_name` + `index_id`, use the SIEM view to pivot into surrounding events
26
+
27
+## If you can’t see alerts you expect
28
+- Your org may have **tag-based access control** enabled (alerts require an allowed tag).
29
+- See: **Developer / AI Agent Docs → Database Schema → Tag access control and alert visibility** for the underlying model.
docs/user/overview.md
new
+19
@@ -0,0 +1,19 @@
1
+# User Guide Overview
2
+
3
+CoPilot is a “single pane of glass” for operating an open-source SOC/SIEM stack.
4
+
5
+## Two primary user roles
6
+
7
+### SOC operator / analyst
8
+- Works primarily in **Incident Management** (alerts, cases, triage, tagging, comments, artifacts, reporting).
9
+- Consumes events and detections coming from the SIEM data store.
10
+
11
+### Admin / engineer
12
+- Configures the systems that produce alerts and the data sources behind them (connectors, integrations, network connectors, scheduler jobs, etc.).
13
+- Responsible for keeping the stack healthy and ensuring the right data is being ingested.
14
+
15
+## Mental model
16
+
17
+- **Wazuh Indexer (OpenSearch-backed)** is the primary **event datastore** for SIEM events (endpoints, O365 integrations, network connectors, and other sources).
18
+- **Graylog** commonly produces alerts into the `gl-events*` index pattern, which can then be queried and displayed through CoPilot’s Wazuh Indexer integration.
19
+- CoPilot frequently resolves SIEM documents using **`index_name` + `index_id`**.
docs/user/videos.md
new
+730
@@ -0,0 +1,730 @@
1
+# CoPilot Video Guide
2
+
3
+Use this page as a fast path through the CoPilot video library. Start with the first sections if you are new, then jump to integration or advanced workflows based on your role. Each entry summarizes what is shown, key features, and who benefits most.
4
+
5
+## Start Here: Platform Overview and Installation
6
+
7
+### Copilot - Your Open Source Security Integrator
8
+- Link: https://www.youtube.com/watch?v=qQbex2zAhWI
9
+- Best for: Admin-Engineer
10
+- What you learn:
11
+ - Provides a guided orientation of CoPilot capabilities and where each module fits in day-to-day SOC operations.
12
+ - Shows installation or upgrade flow with emphasis on prerequisites and expected post-install state.
13
+ - Clarifies how CoPilot becomes the control plane across open-source SIEM and investigation tooling.
14
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
15
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
16
+ - Provides a concise end-to-end example that connects configuration, validation, and operational usage.
17
+- Key CoPilot features shown: Platform onboarding
18
+
19
+### Copilot - Your Next Open Source Security Tool
20
+- Link: https://www.youtube.com/watch?v=CQolYA30Gls
21
+- Best for: Admin-Engineer
22
+- What you learn:
23
+ - Provides a guided orientation of CoPilot capabilities and where each module fits in day-to-day SOC operations.
24
+ - Shows installation or upgrade flow with emphasis on prerequisites and expected post-install state.
25
+ - Clarifies how CoPilot becomes the control plane across open-source SIEM and investigation tooling.
26
+ - Demonstrates alert flow from detection source into CoPilot incident views.
27
+ - Demonstrates customer-aware workflows and tenant context handling.
28
+ - Uses API-driven actions to push, pull, or validate security operations data.
29
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
30
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
31
+- Key CoPilot features shown: Grafana integration, Shuffle SOAR integration, Platform onboarding
32
+
33
+### CoPilot Install
34
+- Link: https://www.youtube.com/watch?v=seITDGXAiJw
35
+- Best for: Admin-Engineer
36
+- What you learn:
37
+ - Provides a guided orientation of CoPilot capabilities and where each module fits in day-to-day SOC operations.
38
+ - Shows installation or upgrade flow with emphasis on prerequisites and expected post-install state.
39
+ - Clarifies how CoPilot becomes the control plane across open-source SIEM and investigation tooling.
40
+ - Covers install/upgrade checkpoints and common misconfiguration pitfalls during initial setup.
41
+ - Shows connector setup steps and validation inside CoPilot.
42
+ - Walks through Docker Compose or service-level deployment changes.
43
+ - Explains how index/search data is selected and mapped for operations.
44
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
45
+- Key CoPilot features shown: Platform onboarding
46
+
47
+### CoPilot Install -- Final Update (I Hope)
48
+- Link: https://www.youtube.com/watch?v=7dUHSMWWTuY
49
+- Best for: Admin-Engineer
50
+- What you learn:
51
+ - Provides a guided orientation of CoPilot capabilities and where each module fits in day-to-day SOC operations.
52
+ - Shows installation or upgrade flow with emphasis on prerequisites and expected post-install state.
53
+ - Clarifies how CoPilot becomes the control plane across open-source SIEM and investigation tooling.
54
+ - Covers install/upgrade checkpoints and common misconfiguration pitfalls during initial setup.
55
+ - Shows connector setup steps and validation inside CoPilot.
56
+ - Walks through Docker Compose or service-level deployment changes.
57
+ - Highlights required service reload/restart points after configuration changes.
58
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
59
+- Key CoPilot features shown: Grafana integration, Platform onboarding
60
+
61
+## Core SOC Workflows: Alerting, Case Management, and Investigations
62
+
63
+### Wazuh Content Pack For Graylog - Easily Configure Your SOCFortress SIEM Stack
64
+- Link: https://www.youtube.com/watch?v=euFrHP0VkD8
65
+- Best for: Both
66
+- What you learn:
67
+ - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
68
+ - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
69
+ - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
70
+ - Shows connector setup steps and validation inside CoPilot.
71
+ - Highlights required service reload/restart points after configuration changes.
72
+ - Demonstrates alert flow from detection source into CoPilot incident views.
73
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
74
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
75
+- Key CoPilot features shown: Wazuh integration, Graylog connector, Grafana integration, Incident management, Alert triage UI
76
+
77
+### Wazuh Security Configuration Assessment and CoPilot - Are Your Endpoints Compliant?
78
+- Link: https://www.youtube.com/watch?v=ffAnV31Ne54
79
+- Best for: Both
80
+- What you learn:
81
+ - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
82
+ - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
83
+ - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
84
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
85
+ - Uses API-driven actions to push, pull, or validate security operations data.
86
+ - Shows practical filtering/search techniques for triage speed.
87
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
88
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
89
+- Key CoPilot features shown: Wazuh integration, SCA visibility, Incident management, Alert triage UI
90
+
91
+### Powerful Wazuh Alert Management With CoPilot!
92
+- Link: https://www.youtube.com/watch?v=3p6qiH9UF8U
93
+- Best for: Operator
94
+- What you learn:
95
+ - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
96
+ - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
97
+ - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
98
+ - Breaks down alert lifecycle handling and practical techniques for reducing analyst overload.
99
+ - Shows connector setup steps and validation inside CoPilot.
100
+ - Demonstrates alert flow from detection source into CoPilot incident views.
101
+ - Explains how index/search data is selected and mapped for operations.
102
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
103
+- Key CoPilot features shown: Wazuh integration, Built-in case management, Incident management, Alert triage UI
104
+
105
+### Introducing the Datastore in CoPilot: Upload Artifacts into Cases with Ease
106
+- Link: https://www.youtube.com/watch?v=GwPyKM2X1EM
107
+- Best for: Operator
108
+- What you learn:
109
+ - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
110
+ - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
111
+ - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
112
+ - Demonstrates uploading and attaching investigation artifacts directly into cases for evidence continuity.
113
+ - Walks through Docker Compose or service-level deployment changes.
114
+ - Demonstrates alert flow from detection source into CoPilot incident views.
115
+ - Demonstrates customer-aware workflows and tenant context handling.
116
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
117
+- Key CoPilot features shown: Case datastore/artifact uploads, Incident management, Alert triage UI
118
+
119
+### Supercharge Open-Source Cybersecurity: Velociraptor + Sigma for Your SIEM
120
+- Link: https://www.youtube.com/watch?v=S2ELWusHcxA
121
+- Best for: Both
122
+- What you learn:
123
+ - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
124
+ - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
125
+ - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
126
+ - Demonstrates alert flow from detection source into CoPilot incident views.
127
+ - Explains how index/search data is selected and mapped for operations.
128
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
129
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
130
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
131
+- Key CoPilot features shown: Velociraptor integration, Sigma rule workflow, SCA visibility, Incident management, Alert triage UI
132
+
133
+### Manage Wazuh Detection Rules with CoPilot
134
+- Link: https://www.youtube.com/watch?v=31lCr80-NVM
135
+- Best for: Admin-Engineer
136
+- What you learn:
137
+ - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
138
+ - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
139
+ - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
140
+ - Shows rule editing/tuning workflow so detections can be refined without leaving CoPilot.
141
+ - Highlights required service reload/restart points after configuration changes.
142
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
143
+ - Uses API-driven actions to push, pull, or validate security operations data.
144
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
145
+- Key CoPilot features shown: Wazuh integration, Detection rule management, Incident management, Alert triage UI
146
+
147
+### Open Source SIEM Response | Dynamic Endpoint Actions with SOCFortress CoPilot
148
+- Link: https://www.youtube.com/watch?v=l9OLtgemYOQ
149
+- Best for: Both
150
+- What you learn:
151
+ - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
152
+ - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
153
+ - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
154
+ - Explains how index/search data is selected and mapped for operations.
155
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
156
+ - Uses API-driven actions to push, pull, or validate security operations data.
157
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
158
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
159
+- Key CoPilot features shown: Velociraptor integration, Active response automation, Vulnerability visibility, Incident management, Alert triage UI
160
+
161
+### Endpoint Investigation Made Easier: New Velociraptor Features in SOCFORTRESS CoPilot
162
+- Link: https://www.youtube.com/watch?v=R_pG1Gx_7O8
163
+- Best for: Operator
164
+- What you learn:
165
+ - Walks through core alert-to-case workflow so analysts can move from detection to tracked investigation quickly.
166
+ - Shows how context (customer, asset, enrichment data) is surfaced to reduce triage friction.
167
+ - Demonstrates practical UI actions for prioritization, ownership, and investigation progress tracking.
168
+ - Demonstrates alert flow from detection source into CoPilot incident views.
169
+ - Uses API-driven actions to push, pull, or validate security operations data.
170
+ - Connects alert context to endpoint/asset details for analyst decision making.
171
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
172
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
173
+- Key CoPilot features shown: Velociraptor integration, Incident management, Alert triage UI
174
+
175
+## AI Analyst and Assistant Workflows
176
+
177
+### AI Analyst for Wazuh Alerts: Revolutionize Your SOC with SOCFortress Copilot!
178
+- Link: https://www.youtube.com/watch?v=-2srPC-Dw-0
179
+- Best for: Both
180
+- What you learn:
181
+ - Demonstrates natural-language investigation workflows that reduce manual querying in backend systems.
182
+ - Shows how AI responses can accelerate common SOC questions and operational checks.
183
+ - Covers the boundary between assisted analysis and operator validation for reliable decisions.
184
+ - Shows guided querying against CoPilot and backend systems using natural language prompts.
185
+ - Demonstrates alert flow from detection source into CoPilot incident views.
186
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
187
+ - Connects alert context to endpoint/asset details for analyst decision making.
188
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
189
+- Key CoPilot features shown: Wazuh integration, AI analyst, AI-assisted investigation
190
+
191
+### AI Agent for Open Source SIEM: Wazuh, Velociraptor + CoPilot!
192
+- Link: https://www.youtube.com/watch?v=FHjD9QBaLD4
193
+- Best for: Both
194
+- What you learn:
195
+ - Demonstrates natural-language investigation workflows that reduce manual querying in backend systems.
196
+ - Shows how AI responses can accelerate common SOC questions and operational checks.
197
+ - Covers the boundary between assisted analysis and operator validation for reliable decisions.
198
+ - Shows guided querying against CoPilot and backend systems using natural language prompts.
199
+ - Walks through Docker Compose or service-level deployment changes.
200
+ - Demonstrates alert flow from detection source into CoPilot incident views.
201
+ - Explains how index/search data is selected and mapped for operations.
202
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
203
+- Key CoPilot features shown: Wazuh integration, Velociraptor integration, AI agent, AI-assisted investigation
204
+
205
+### AI Chatbot Now With Threat Intel, Cyber News, Knowledge Base & Attack Surface!
206
+- Link: https://www.youtube.com/watch?v=QaLrmSgEcLI
207
+- Best for: Both
208
+- What you learn:
209
+ - Demonstrates natural-language investigation workflows that reduce manual querying in backend systems.
210
+ - Shows how AI responses can accelerate common SOC questions and operational checks.
211
+ - Covers the boundary between assisted analysis and operator validation for reliable decisions.
212
+ - Shows guided querying against CoPilot and backend systems using natural language prompts.
213
+ - Explains how index/search data is selected and mapped for operations.
214
+ - Uses API-driven actions to push, pull, or validate security operations data.
215
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
216
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
217
+- Key CoPilot features shown: Velociraptor integration, AI chatbot, AI-assisted investigation
218
+
219
+## Detection Engineering and Response Automation
220
+
221
+### Automate Your SOC: Triggering Alerts with Wazuh Rules via Copilot
222
+- Link: https://www.youtube.com/watch?v=tguRiVgytso
223
+- Best for: Both
224
+- What you learn:
225
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
226
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
227
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
228
+ - Shows connector setup steps and validation inside CoPilot.
229
+ - Walks through Docker Compose or service-level deployment changes.
230
+ - Demonstrates alert flow from detection source into CoPilot incident views.
231
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
232
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
233
+- Key CoPilot features shown: Wazuh integration, Detection tuning
234
+
235
+### Wazuh Rule Writing With CoPilot AI Module - Handle Your Alert Flooding
236
+- Link: https://www.youtube.com/watch?v=AH1g3p8s2_o
237
+- Best for: Both
238
+- What you learn:
239
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
240
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
241
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
242
+ - Shows rule editing/tuning workflow so detections can be refined without leaving CoPilot.
243
+ - Walks through Docker Compose or service-level deployment changes.
244
+ - Highlights required service reload/restart points after configuration changes.
245
+ - Demonstrates alert flow from detection source into CoPilot incident views.
246
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
247
+- Key CoPilot features shown: Wazuh integration, Detection tuning
248
+
249
+### Mastering Wazuh's Active Response: Block Malicious IPs with CoPilot & Wazuh!
250
+- Link: https://www.youtube.com/watch?v=llm3uSSUhqs
251
+- Best for: Both
252
+- What you learn:
253
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
254
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
255
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
256
+ - Demonstrates response actions tied to detections, including safer execution and control boundaries.
257
+ - Highlights required service reload/restart points after configuration changes.
258
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
259
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
260
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
261
+- Key CoPilot features shown: Wazuh integration, Active response automation, Detection tuning
262
+
263
+### Revolutionize Your SIEM Alerts: Integrate CoPilot & Shuffle
264
+- Link: https://www.youtube.com/watch?v=Ko5jLfkSCrk
265
+- Best for: Both
266
+- What you learn:
267
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
268
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
269
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
270
+ - Shows SOC automation orchestration by connecting CoPilot-driven alerts with Shuffle playbooks.
271
+ - Shows connector setup steps and validation inside CoPilot.
272
+ - Demonstrates alert flow from detection source into CoPilot incident views.
273
+ - Demonstrates customer-aware workflows and tenant context handling.
274
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
275
+- Key CoPilot features shown: Shuffle SOAR integration, Detection tuning
276
+
277
+### Tame the Noise: Sigma Exclusions in CoPilot for Velociraptor Alerts
278
+- Link: https://www.youtube.com/watch?v=GWTNA-6Z_Tk
279
+- Best for: Both
280
+- What you learn:
281
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
282
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
283
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
284
+ - Demonstrates alert flow from detection source into CoPilot incident views.
285
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
286
+ - Demonstrates customer-aware workflows and tenant context handling.
287
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
288
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
289
+- Key CoPilot features shown: Velociraptor integration, Sigma rule workflow, Sysmon config management, Detection tuning
290
+
291
+### 🚀 Master Sysmon Config Management with CoPilot & Wazuh!
292
+- Link: https://www.youtube.com/watch?v=XT1d49HTqQw
293
+- Best for: Both
294
+- What you learn:
295
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
296
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
297
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
298
+ - Shows connector setup steps and validation inside CoPilot.
299
+ - Highlights required service reload/restart points after configuration changes.
300
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
301
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
302
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
303
+- Key CoPilot features shown: Wazuh integration, Sysmon config management, Detection tuning
304
+
305
+### Supercharge Wazuh Active Response with CoPilot: No More Limits!
306
+- Link: https://www.youtube.com/watch?v=Ogr70DWAeTc
307
+- Best for: Both
308
+- What you learn:
309
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
310
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
311
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
312
+ - Demonstrates response actions tied to detections, including safer execution and control boundaries.
313
+ - Highlights required service reload/restart points after configuration changes.
314
+ - Demonstrates alert flow from detection source into CoPilot incident views.
315
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
316
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
317
+- Key CoPilot features shown: Wazuh integration, Active response automation, Detection tuning
318
+
319
+### Test Your Wazuh Detection Rules: One-Click Atomic Red Team + Velociraptor + CoPilot
320
+- Link: https://www.youtube.com/watch?v=TMJOBATTK9M
321
+- Best for: Both
322
+- What you learn:
323
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
324
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
325
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
326
+ - Shows rule editing/tuning workflow so detections can be refined without leaving CoPilot.
327
+ - Uses adversary simulation to validate that detection logic and alert routing behave as expected.
328
+ - Demonstrates alert flow from detection source into CoPilot incident views.
329
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
330
+ - Shows practical filtering/search techniques for triage speed.
331
+- Key CoPilot features shown: Wazuh integration, Velociraptor integration, Atomic Red Team testing, Detection rule management, Detection tuning
332
+
333
+### Simulate Linux Attacks and Tune Detection Rules with Atomic Red Team
334
+- Link: https://www.youtube.com/watch?v=tL3oNEx_3M8
335
+- Best for: Both
336
+- What you learn:
337
+ - Shows how to move from static detections to repeatable engineering workflows for better signal quality.
338
+ - Demonstrates automation patterns that reduce repetitive analyst actions during containment and response.
339
+ - Covers testing/tuning loops so rule or response changes can be validated before broad rollout.
340
+ - Shows rule editing/tuning workflow so detections can be refined without leaving CoPilot.
341
+ - Uses adversary simulation to validate that detection logic and alert routing behave as expected.
342
+ - Highlights required service reload/restart points after configuration changes.
343
+ - Demonstrates alert flow from detection source into CoPilot incident views.
344
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
345
+- Key CoPilot features shown: Atomic Red Team testing, Detection rule management, Detection tuning
346
+
347
+## Integrations and Log Ingestion
348
+
349
+### Wazuh Indexer and CoPilot Integration
350
+- Link: https://www.youtube.com/watch?v=MKqByrkDqZU
351
+- Best for: Admin-Engineer
352
+- What you learn:
353
+ - Explains how to onboard external log sources and integrations into a consistent CoPilot workflow.
354
+ - Shows field mapping and source-specific considerations so data arrives usable for alerting and triage.
355
+ - Demonstrates validation steps to confirm events are flowing end-to-end into the SIEM/CoPilot pipeline.
356
+ - Shows connector setup steps and validation inside CoPilot.
357
+ - Explains how index/search data is selected and mapped for operations.
358
+ - Uses API-driven actions to push, pull, or validate security operations data.
359
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
360
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
361
+- Key CoPilot features shown: Wazuh integration, Connector onboarding
362
+
363
+### Graylog and CoPilot Integration
364
+- Link: https://www.youtube.com/watch?v=MyvPmQ4Cfb0
365
+- Best for: Admin-Engineer
366
+- What you learn:
367
+ - Explains how to onboard external log sources and integrations into a consistent CoPilot workflow.
368
+ - Shows field mapping and source-specific considerations so data arrives usable for alerting and triage.
369
+ - Demonstrates validation steps to confirm events are flowing end-to-end into the SIEM/CoPilot pipeline.
370
+ - Shows connector setup steps and validation inside CoPilot.
371
+ - Demonstrates alert flow from detection source into CoPilot incident views.
372
+ - Explains how index/search data is selected and mapped for operations.
373
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
374
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
375
+- Key CoPilot features shown: Graylog connector, Connector onboarding
376
+
377
+### Wazuh Manager and CoPilot Integration
378
+- Link: https://www.youtube.com/watch?v=iI6yKgKC5wk
379
+- Best for: Admin-Engineer
380
+- What you learn:
381
+ - Explains how to onboard external log sources and integrations into a consistent CoPilot workflow.
382
+ - Shows field mapping and source-specific considerations so data arrives usable for alerting and triage.
383
+ - Demonstrates validation steps to confirm events are flowing end-to-end into the SIEM/CoPilot pipeline.
384
+ - Shows connector setup steps and validation inside CoPilot.
385
+ - Uses API-driven actions to push, pull, or validate security operations data.
386
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
387
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
388
+- Key CoPilot features shown: Wazuh integration, Connector onboarding
389
+
390
+### Velociraptor and Copilot Integration
391
+- Link: https://www.youtube.com/watch?v=-Cqyczg6ELE
392
+- Best for: Admin-Engineer
393
+- What you learn:
394
+ - Explains how to onboard external log sources and integrations into a consistent CoPilot workflow.
395
+ - Shows field mapping and source-specific considerations so data arrives usable for alerting and triage.
396
+ - Demonstrates validation steps to confirm events are flowing end-to-end into the SIEM/CoPilot pipeline.
397
+ - Shows connector setup steps and validation inside CoPilot.
398
+ - Uses API-driven actions to push, pull, or validate security operations data.
399
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
400
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
401
+- Key CoPilot features shown: Velociraptor integration, Connector onboarding
402
+
403
+### CoPilot And InfluxDB - Monitor Your SIEM Stack Servers with InfluxDB and CoPilot!
404
+- Link: https://www.youtube.com/watch?v=vt6M1SzNfjE
405
+- Best for: Admin-Engineer
406
+- What you learn:
407
+ - Explains how to onboard external log sources and integrations into a consistent CoPilot workflow.
408
+ - Shows field mapping and source-specific considerations so data arrives usable for alerting and triage.
409
+ - Demonstrates validation steps to confirm events are flowing end-to-end into the SIEM/CoPilot pipeline.
410
+ - Shows connector setup steps and validation inside CoPilot.
411
+ - Demonstrates alert flow from detection source into CoPilot incident views.
412
+ - Uses API-driven actions to push, pull, or validate security operations data.
413
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
414
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
415
+- Key CoPilot features shown: Grafana integration, InfluxDB metrics integration, Connector onboarding
416
+
417
+### DFIR-IRIS and CoPilot - Bring your SOC Alerts into CoPilot
418
+- Link: https://www.youtube.com/watch?v=n9koQ1UL-L0
419
+- Best for: Admin-Engineer
420
+- What you learn:
421
+ - Explains how to onboard external log sources and integrations into a consistent CoPilot workflow.
422
+ - Shows field mapping and source-specific considerations so data arrives usable for alerting and triage.
423
+ - Demonstrates validation steps to confirm events are flowing end-to-end into the SIEM/CoPilot pipeline.
424
+ - Shows connector setup steps and validation inside CoPilot.
425
+ - Demonstrates alert flow from detection source into CoPilot incident views.
426
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
427
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
428
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
429
+- Key CoPilot features shown: Built-in case management, SCA visibility, Connector onboarding
430
+
431
+### Grafana and CoPilot Integration
432
+- Link: https://www.youtube.com/watch?v=FOOU1PQnd7g
433
+- Best for: Admin-Engineer
434
+- What you learn:
435
+ - Explains how to onboard external log sources and integrations into a consistent CoPilot workflow.
436
+ - Shows field mapping and source-specific considerations so data arrives usable for alerting and triage.
437
+ - Demonstrates validation steps to confirm events are flowing end-to-end into the SIEM/CoPilot pipeline.
438
+ - Shows connector setup steps and validation inside CoPilot.
439
+ - Demonstrates customer-aware workflows and tenant context handling.
440
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
441
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
442
+- Key CoPilot features shown: Grafana integration, Connector onboarding
443
+
444
+### Seamless Office365 Integration with Wazuh: Simplified by Copilot
445
+- Link: https://www.youtube.com/watch?v=ihj2F2rA6BQ
446
+- Best for: Admin-Engineer
447
+- What you learn:
448
+ - Explains how to onboard external log sources and integrations into a consistent CoPilot workflow.
449
+ - Shows field mapping and source-specific considerations so data arrives usable for alerting and triage.
450
+ - Demonstrates validation steps to confirm events are flowing end-to-end into the SIEM/CoPilot pipeline.
451
+ - Explains how index/search data is selected and mapped for operations.
452
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
453
+ - Demonstrates customer-aware workflows and tenant context handling.
454
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
455
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
456
+- Key CoPilot features shown: Wazuh integration, Office 365 connector, Connector onboarding
457
+
458
+### Unlock Full SIEM Potential: Effortlessly Ingest Crowdstrike Events Into Your Open Source SIEM!
459
+- Link: https://www.youtube.com/watch?v=YOVUOpZDEzM
460
+- Best for: Admin-Engineer
461
+- What you learn:
462
+ - Explains how to onboard external log sources and integrations into a consistent CoPilot workflow.
463
+ - Shows field mapping and source-specific considerations so data arrives usable for alerting and triage.
464
+ - Demonstrates validation steps to confirm events are flowing end-to-end into the SIEM/CoPilot pipeline.
465
+ - Demonstrates scalable ingestion patterns for third-party events into the security data pipeline.
466
+ - Shows connector setup steps and validation inside CoPilot.
467
+ - Walks through Docker Compose or service-level deployment changes.
468
+ - Highlights required service reload/restart points after configuration changes.
469
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
470
+- Key CoPilot features shown: CrowdStrike ingestion, Customer portal, Connector onboarding
471
+
472
+### CoPilot Event Shipper Configuration - Ingest 3rd Party Logs into your SIEM Stack
473
+- Link: https://www.youtube.com/watch?v=tgWRvOJX5HA
474
+- Best for: Admin-Engineer
475
+- What you learn:
476
+ - Explains how to onboard external log sources and integrations into a consistent CoPilot workflow.
477
+ - Shows field mapping and source-specific considerations so data arrives usable for alerting and triage.
478
+ - Demonstrates validation steps to confirm events are flowing end-to-end into the SIEM/CoPilot pipeline.
479
+ - Demonstrates scalable ingestion patterns for third-party events into the security data pipeline.
480
+ - Shows connector setup steps and validation inside CoPilot.
481
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
482
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
483
+- Key CoPilot features shown: DUO MFA ingestion, Event shipper, Connector onboarding
484
+
485
+### Unlock Full SIEM Potential: Effortlessly Ingest DUO MFA Events Into Your Open Source SIEM!
486
+- Link: https://www.youtube.com/watch?v=chTthkpMpTY
487
+- Best for: Admin-Engineer
488
+- What you learn:
489
+ - Explains how to onboard external log sources and integrations into a consistent CoPilot workflow.
490
+ - Shows field mapping and source-specific considerations so data arrives usable for alerting and triage.
491
+ - Demonstrates validation steps to confirm events are flowing end-to-end into the SIEM/CoPilot pipeline.
492
+ - Demonstrates scalable ingestion patterns for third-party events into the security data pipeline.
493
+ - Walks through Docker Compose or service-level deployment changes.
494
+ - Explains how index/search data is selected and mapped for operations.
495
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
496
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
497
+- Key CoPilot features shown: DUO MFA ingestion, Event shipper, Connector onboarding
498
+
499
+### New MITRE ATT&CK Integration in CoPilot – Game Changer for SOC Analysts!
500
+- Link: https://www.youtube.com/watch?v=wK4aA7QrXmE
501
+- Best for: Admin-Engineer
502
+- What you learn:
503
+ - Explains how to onboard external log sources and integrations into a consistent CoPilot workflow.
504
+ - Shows field mapping and source-specific considerations so data arrives usable for alerting and triage.
505
+ - Demonstrates validation steps to confirm events are flowing end-to-end into the SIEM/CoPilot pipeline.
506
+ - Explains ATT&CK mapping benefits for investigation context and coverage discussions.
507
+ - Demonstrates alert flow from detection source into CoPilot incident views.
508
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
509
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
510
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
511
+- Key CoPilot features shown: MITRE ATT&CK mapping, Connector onboarding
512
+
513
+### Supercharge Your Log Ingestion: Webhooks to SIEM Made Easy
514
+- Link: https://www.youtube.com/watch?v=O5SaFwAMMtA
515
+- Best for: Admin-Engineer
516
+- What you learn:
517
+ - Explains how to onboard external log sources and integrations into a consistent CoPilot workflow.
518
+ - Shows field mapping and source-specific considerations so data arrives usable for alerting and triage.
519
+ - Demonstrates validation steps to confirm events are flowing end-to-end into the SIEM/CoPilot pipeline.
520
+ - Demonstrates scalable ingestion patterns for third-party events into the security data pipeline.
521
+ - Shows connector setup steps and validation inside CoPilot.
522
+ - Explains how index/search data is selected and mapped for operations.
523
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
524
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
525
+- Key CoPilot features shown: Webhook ingestion pipeline, Shuffle SOAR integration, Connector onboarding
526
+
527
+## Threat Intelligence, Vulnerability, and Security Posture
528
+
529
+### Auto-Enrich Wazuh Events with Threat Intel Feeds!
530
+- Link: https://www.youtube.com/watch?v=FJunzP2c_mQ
531
+- Best for: Both
532
+- What you learn:
533
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
534
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
535
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
536
+ - Demonstrates alert flow from detection source into CoPilot incident views.
537
+ - Explains how index/search data is selected and mapped for operations.
538
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
539
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
540
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
541
+- Key CoPilot features shown: Wazuh integration, Enrichment workflows
542
+
543
+### Analyzing Processes in Wazuh Alerts with Advanced Risk Scoring from Global Data
544
+- Link: https://www.youtube.com/watch?v=CVVj9HRtjOE
545
+- Best for: Both
546
+- What you learn:
547
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
548
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
549
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
550
+ - Demonstrates alert flow from detection source into CoPilot incident views.
551
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
552
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
553
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
554
+- Key CoPilot features shown: Wazuh integration, Enrichment workflows
555
+
556
+### Simplify Cloud Security: ScoutSuite and Copilot Tutorial
557
+- Link: https://www.youtube.com/watch?v=G3MDJSMvnRo
558
+- Best for: Both
559
+- What you learn:
560
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
561
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
562
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
563
+ - Demonstrates customer-aware workflows and tenant context handling.
564
+ - Uses API-driven actions to push, pull, or validate security operations data.
565
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
566
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
567
+- Key CoPilot features shown: SCA visibility, Enrichment workflows
568
+
569
+### Integrate EPSS with Wazuh for Top-Notch Vulnerability Management!
570
+- Link: https://www.youtube.com/watch?v=Qnm9SXVJGWw
571
+- Best for: Both
572
+- What you learn:
573
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
574
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
575
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
576
+ - Connects exposure data to prioritization so teams can address the highest-risk items first.
577
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
578
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
579
+- Key CoPilot features shown: Wazuh integration, EPSS enrichment, Vulnerability visibility, Enrichment workflows
580
+
581
+### Enhancing Web App Security: Integrating Copilot with Nuclei for Vulnerability Scanning
582
+- Link: https://www.youtube.com/watch?v=-SVHKuQUxlI
583
+- Best for: Both
584
+- What you learn:
585
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
586
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
587
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
588
+ - Connects exposure data to prioritization so teams can address the highest-risk items first.
589
+ - Walks through Docker Compose or service-level deployment changes.
590
+ - Uses API-driven actions to push, pull, or validate security operations data.
591
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
592
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
593
+- Key CoPilot features shown: DUO MFA ingestion, Nuclei scanning integration, SCA visibility, Vulnerability visibility, Enrichment workflows
594
+
595
+### Boost CoPilot: IoCs from Wazuh + VirusTotal Enrichment
596
+- Link: https://www.youtube.com/watch?v=fNybop2FTRE
597
+- Best for: Both
598
+- What you learn:
599
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
600
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
601
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
602
+ - Shows malware/IoC enrichment flow and how reputation context changes triage decisions.
603
+ - Shows connector setup steps and validation inside CoPilot.
604
+ - Walks through Docker Compose or service-level deployment changes.
605
+ - Demonstrates alert flow from detection source into CoPilot incident views.
606
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
607
+- Key CoPilot features shown: Wazuh integration, VirusTotal enrichment, Enrichment workflows
608
+
609
+### CoPilot + VirusTotal: Instantly Scan Files for Malware!
610
+- Link: https://www.youtube.com/watch?v=ixxVe_9LAfQ
611
+- Best for: Both
612
+- What you learn:
613
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
614
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
615
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
616
+ - Shows malware/IoC enrichment flow and how reputation context changes triage decisions.
617
+ - Connects exposure data to prioritization so teams can address the highest-risk items first.
618
+ - Shows connector setup steps and validation inside CoPilot.
619
+ - Uses API-driven actions to push, pull, or validate security operations data.
620
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
621
+- Key CoPilot features shown: VirusTotal enrichment, SCA visibility, Enrichment workflows
622
+
623
+### CoPilot Supercharges Wazuh with SCA & Vulnerability Overviews
624
+- Link: https://www.youtube.com/watch?v=NUrnlTvLzVk
625
+- Best for: Both
626
+- What you learn:
627
+ - Shows how enrichment data is layered onto alerts to improve confidence and prioritization.
628
+ - Demonstrates workflows for vulnerability, exposure, or threat context inside CoPilot operations.
629
+ - Highlights how analysts can convert external intelligence into actionable triage or response steps.
630
+ - Connects exposure data to prioritization so teams can address the highest-risk items first.
631
+ - Explains how index/search data is selected and mapped for operations.
632
+ - Demonstrates customer-aware workflows and tenant context handling.
633
+ - Shows practical filtering/search techniques for triage speed.
634
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
635
+- Key CoPilot features shown: Wazuh integration, SCA visibility, Vulnerability visibility, Enrichment workflows
636
+
637
+## Operations, Reporting, and Customer Experience
638
+
639
+### Wazuh Dashboards in Grafana & Customer Provisioning in CoPilot!
640
+- Link: https://www.youtube.com/watch?v=hC0JHY5WF-U
641
+- Best for: Admin-Engineer
642
+- What you learn:
643
+ - Focuses on operational maturity features for customer-facing SOC delivery and service consistency.
644
+ - Shows how to package and present outcomes for stakeholders with less manual effort.
645
+ - Demonstrates platform workflows that improve repeatability across customers and analysts.
646
+ - Shows reporting/dashboard workflows to communicate security posture and outcomes clearly.
647
+ - Demonstrates alert flow from detection source into CoPilot incident views.
648
+ - Explains how index/search data is selected and mapped for operations.
649
+ - Covers rule logic, filtering, or tuning considerations for higher-fidelity detections.
650
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
651
+- Key CoPilot features shown: Wazuh integration, Grafana integration, Multi-tenant operations
652
+
653
+### Create Custom PDF Reports in Grafana Detailing Security Events | Share with Your Clients!
654
+- Link: https://www.youtube.com/watch?v=9xHr5-Wlypw
655
+- Best for: Admin-Engineer
656
+- What you learn:
657
+ - Focuses on operational maturity features for customer-facing SOC delivery and service consistency.
658
+ - Shows how to package and present outcomes for stakeholders with less manual effort.
659
+ - Demonstrates platform workflows that improve repeatability across customers and analysts.
660
+ - Shows reporting/dashboard workflows to communicate security posture and outcomes clearly.
661
+ - Shows connector setup steps and validation inside CoPilot.
662
+ - Demonstrates alert flow from detection source into CoPilot incident views.
663
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
664
+ - Emphasizes outcomes analysts/admins should verify after each configuration or workflow change.
665
+- Key CoPilot features shown: Grafana integration, Reporting workflow, Multi-tenant operations
666
+
667
+### A Customer Portal for Your Open-Source SIEM Stack
668
+- Link: https://www.youtube.com/watch?v=_bvFejcFwFM
669
+- Best for: Admin-Engineer
670
+- What you learn:
671
+ - Focuses on operational maturity features for customer-facing SOC delivery and service consistency.
672
+ - Shows how to package and present outcomes for stakeholders with less manual effort.
673
+ - Demonstrates platform workflows that improve repeatability across customers and analysts.
674
+ - Introduces customer-facing portal workflows for transparent, self-service visibility.
675
+ - Walks through Docker Compose or service-level deployment changes.
676
+ - Demonstrates alert flow from detection source into CoPilot incident views.
677
+ - Demonstrates customer-aware workflows and tenant context handling.
678
+ - Includes practical walkthrough steps that can be replicated in production-like SOC environments.
679
+- Key CoPilot features shown: Customer portal, Multi-tenant operations
680
+
681
+## Index
682
+
683
+- [Copilot - Your Open Source Security Integrator](https://www.youtube.com/watch?v=qQbex2zAhWI)
684
+- [Copilot - Your Next Open Source Security Tool](https://www.youtube.com/watch?v=CQolYA30Gls)
685
+- [CoPilot Install](https://www.youtube.com/watch?v=seITDGXAiJw)
686
+- [CoPilot Install -- Final Update (I Hope)](https://www.youtube.com/watch?v=7dUHSMWWTuY)
687
+- [Wazuh Content Pack For Graylog - Easily Configure Your SOCFortress SIEM Stack](https://www.youtube.com/watch?v=euFrHP0VkD8)
688
+- [Wazuh Security Configuration Assessment and CoPilot - Are Your Endpoints Compliant?](https://www.youtube.com/watch?v=ffAnV31Ne54)
689
+- [Powerful Wazuh Alert Management With CoPilot!](https://www.youtube.com/watch?v=3p6qiH9UF8U)
690
+- [Introducing the Datastore in CoPilot: Upload Artifacts into Cases with Ease](https://www.youtube.com/watch?v=GwPyKM2X1EM)
691
+- [Supercharge Open-Source Cybersecurity: Velociraptor + Sigma for Your SIEM](https://www.youtube.com/watch?v=S2ELWusHcxA)
692
+- [Manage Wazuh Detection Rules with CoPilot](https://www.youtube.com/watch?v=31lCr80-NVM)
693
+- [Open Source SIEM Response | Dynamic Endpoint Actions with SOCFortress CoPilot](https://www.youtube.com/watch?v=l9OLtgemYOQ)
694
+- [Endpoint Investigation Made Easier: New Velociraptor Features in SOCFORTRESS CoPilot](https://www.youtube.com/watch?v=R_pG1Gx_7O8)
695
+- [AI Analyst for Wazuh Alerts: Revolutionize Your SOC with SOCFortress Copilot!](https://www.youtube.com/watch?v=-2srPC-Dw-0)
696
+- [AI Agent for Open Source SIEM: Wazuh, Velociraptor + CoPilot!](https://www.youtube.com/watch?v=FHjD9QBaLD4)
697
+- [AI Chatbot Now With Threat Intel, Cyber News, Knowledge Base & Attack Surface!](https://www.youtube.com/watch?v=QaLrmSgEcLI)
698
+- [Automate Your SOC: Triggering Alerts with Wazuh Rules via Copilot](https://www.youtube.com/watch?v=tguRiVgytso)
699
+- [Wazuh Rule Writing With CoPilot AI Module - Handle Your Alert Flooding](https://www.youtube.com/watch?v=AH1g3p8s2_o)
700
+- [Mastering Wazuh's Active Response: Block Malicious IPs with CoPilot & Wazuh!](https://www.youtube.com/watch?v=llm3uSSUhqs)
701
+- [Revolutionize Your SIEM Alerts: Integrate CoPilot & Shuffle](https://www.youtube.com/watch?v=Ko5jLfkSCrk)
702
+- [Tame the Noise: Sigma Exclusions in CoPilot for Velociraptor Alerts](https://www.youtube.com/watch?v=GWTNA-6Z_Tk)
703
+- [🚀 Master Sysmon Config Management with CoPilot & Wazuh!](https://www.youtube.com/watch?v=XT1d49HTqQw)
704
+- [Supercharge Wazuh Active Response with CoPilot: No More Limits!](https://www.youtube.com/watch?v=Ogr70DWAeTc)
705
+- [Test Your Wazuh Detection Rules: One-Click Atomic Red Team + Velociraptor + CoPilot](https://www.youtube.com/watch?v=TMJOBATTK9M)
706
+- [Simulate Linux Attacks and Tune Detection Rules with Atomic Red Team](https://www.youtube.com/watch?v=tL3oNEx_3M8)
707
+- [Wazuh Indexer and CoPilot Integration](https://www.youtube.com/watch?v=MKqByrkDqZU)
708
+- [Graylog and CoPilot Integration](https://www.youtube.com/watch?v=MyvPmQ4Cfb0)
709
+- [Wazuh Manager and CoPilot Integration](https://www.youtube.com/watch?v=iI6yKgKC5wk)
710
+- [Velociraptor and Copilot Integration](https://www.youtube.com/watch?v=-Cqyczg6ELE)
711
+- [CoPilot And InfluxDB - Monitor Your SIEM Stack Servers with InfluxDB and CoPilot!](https://www.youtube.com/watch?v=vt6M1SzNfjE)
712
+- [DFIR-IRIS and CoPilot - Bring your SOC Alerts into CoPilot](https://www.youtube.com/watch?v=n9koQ1UL-L0)
713
+- [Grafana and CoPilot Integration](https://www.youtube.com/watch?v=FOOU1PQnd7g)
714
+- [Seamless Office365 Integration with Wazuh: Simplified by Copilot](https://www.youtube.com/watch?v=ihj2F2rA6BQ)
715
+- [Unlock Full SIEM Potential: Effortlessly Ingest Crowdstrike Events Into Your Open Source SIEM!](https://www.youtube.com/watch?v=YOVUOpZDEzM)
716
+- [CoPilot Event Shipper Configuration - Ingest 3rd Party Logs into your SIEM Stack](https://www.youtube.com/watch?v=tgWRvOJX5HA)
717
+- [Unlock Full SIEM Potential: Effortlessly Ingest DUO MFA Events Into Your Open Source SIEM!](https://www.youtube.com/watch?v=chTthkpMpTY)
718
+- [New MITRE ATT&CK Integration in CoPilot – Game Changer for SOC Analysts!](https://www.youtube.com/watch?v=wK4aA7QrXmE)
719
+- [Supercharge Your Log Ingestion: Webhooks to SIEM Made Easy](https://www.youtube.com/watch?v=O5SaFwAMMtA)
720
+- [Auto-Enrich Wazuh Events with Threat Intel Feeds!](https://www.youtube.com/watch?v=FJunzP2c_mQ)
721
+- [Analyzing Processes in Wazuh Alerts with Advanced Risk Scoring from Global Data](https://www.youtube.com/watch?v=CVVj9HRtjOE)
722
+- [Simplify Cloud Security: ScoutSuite and Copilot Tutorial](https://www.youtube.com/watch?v=G3MDJSMvnRo)
723
+- [Integrate EPSS with Wazuh for Top-Notch Vulnerability Management!](https://www.youtube.com/watch?v=Qnm9SXVJGWw)
724
+- [Enhancing Web App Security: Integrating Copilot with Nuclei for Vulnerability Scanning](https://www.youtube.com/watch?v=-SVHKuQUxlI)
725
+- [Boost CoPilot: IoCs from Wazuh + VirusTotal Enrichment](https://www.youtube.com/watch?v=fNybop2FTRE)
726
+- [CoPilot + VirusTotal: Instantly Scan Files for Malware!](https://www.youtube.com/watch?v=ixxVe_9LAfQ)
727
+- [CoPilot Supercharges Wazuh with SCA & Vulnerability Overviews](https://www.youtube.com/watch?v=NUrnlTvLzVk)
728
+- [Wazuh Dashboards in Grafana & Customer Provisioning in CoPilot!](https://www.youtube.com/watch?v=hC0JHY5WF-U)
729
+- [Create Custom PDF Reports in Grafana Detailing Security Events | Share with Your Clients!](https://www.youtube.com/watch?v=9xHr5-Wlypw)
730
+- [A Customer Portal for Your Open-Source SIEM Stack](https://www.youtube.com/watch?v=_bvFejcFwFM)
mkdocs.yml
new
+41
@@ -0,0 +1,41 @@
1
+site_name: SOCFortress CoPilot Docs
2
+site_description: User guide and developer/AI-agent documentation for SOCFortress CoPilot
3
+repo_url: https://github.com/socfortress/CoPilot
4
+edit_uri: edit/main/
5
+
6
+theme:
7
+ name: material
8
+ features:
9
+ - navigation.instant
10
+ - navigation.sections
11
+ - navigation.expand
12
+ - navigation.tracking
13
+ - navigation.top
14
+ - content.code.copy
15
+ - search.suggest
16
+ - search.highlight
17
+
18
+markdown_extensions:
19
+ - admonition
20
+ - toc:
21
+ permalink: true
22
+ - tables
23
+ - def_list
24
+ - footnotes
25
+
26
+nav:
27
+ - Home: index.md
28
+ - User Guide:
29
+ - Overview: user/overview.md
30
+ - Quickstart (Operators): user/operators-quickstart.md
31
+ - Quickstart (Admins/Engineers): user/admins-quickstart.md
32
+ - Features by Area: user/features.md
33
+ - Videos (Playlist): user/videos.md
34
+ - Developer / AI Agent Docs:
35
+ - Start Here: README.md
36
+ - Architecture: architecture/ARCHITECTURE.md
37
+ - Map: architecture/MAP.md
38
+ - Deployment: architecture/DEPLOYMENT.md
39
+ - Data Flows: architecture/DATA_FLOWS.md
40
+ - Database Schema: architecture/DATABASE_SCHEMA.md
41
+ - Adding a Connector: integrations/ADDING_A_CONNECTOR.md