@cryptotaxi247 / CoPilot / commits / ebeeb8db

docs: add UI navigation guide (Navbar map + tips) (#703)

Co-authored-by: Clawdbot <clawdbot@Clawdbots-Mac-mini.local>

taylorcopilot committed Feb 14, 2026 at 11:44 UTC ebeeb8db96297d15d7219ec473bad64c63c6d054
2 files changed +159
docs/user/navigation.md new
+158
@@ -0,0 +1,158 @@
1 +# Navigation Guide (UI Map + Tips)
2 +
3 +This page explains what each left‑hand navigation item in CoPilot does and how to use the UI efficiently.
4 +
5 +> Source of truth: `frontend/src/app-layouts/common/Navbar/items.tsx` (nav items) and `frontend/src/router/index.ts` (routes).
6 +
7 +---
8 +
9 +## Quick tips (applies to everyone)
10 +
11 +- **Use the left nav as your workflow map**:
12 + - *Incident Management* = where analysts live (alerts/cases)
13 + - *Connectors / External Services / Indices* = where engineers wire up data and keep the stack healthy
14 +
15 +- **Deep links exist** (helpful for bookmarking / SOPs):
16 + - Incident Alerts can be opened directly via `?alert_id=<id>`
17 + - Incident Cases can be opened directly via `?case_id=<id>`
18 + - Customers supports `?code=<customer_code>` and `?action=add-customer`
19 + - Graylog Management supports tab anchors like `#streams`, `#inputs`, etc.
20 +
21 +---
22 +
23 +## “Where do I start?” by role
24 +
25 +### SOC operator / analyst
26 +
27 +1. **Incident Management → Alerts** (`/incident-management/alerts`)
28 +2. **Incident Management → Cases** (`/incident-management/cases`)
29 +3. **Artifacts** (`/artifacts`) for evidence / files you need to attach or review
30 +
31 +### Admin / engineer
32 +
33 +1. **Connectors** (`/connectors`) – connect the underlying systems (Wazuh, Graylog, Grafana, Velociraptor, etc.)
34 +2. **External Services** (`/external-services/...`) – configure third‑party sources / network connectors
35 +3. **Indices → Index Management** (`/indices/management`) – index health/visibility and troubleshooting
36 +4. **Graylog → Management** (`/graylog/management`) – alert plumbing / streams / inputs / provisioning
37 +
38 +---
39 +
40 +## Left navigation map (what each item does)
41 +
42 +### Overview
43 +
44 +- **Overview** → `/overview`
45 + - High-level dashboard/landing page once logged in.
46 +
47 +### Incident Management (operator-first)
48 +
49 +- **Incident Management → Sources** → `/incident-management/sources`
50 + - Defines/controls *where alerts come from* (your “alert sources” / categories).
51 +
52 +- **Incident Management → Alerts** → `/incident-management/alerts`
53 + - Primary triage queue.
54 + - Deep link: `/incident-management/alerts?alert_id=<id>`
55 +
56 +- **Incident Management → Cases** → `/incident-management/cases`
57 + - Investigation lifecycle management.
58 + - Deep link: `/incident-management/cases?case_id=<id>`
59 +
60 +### Alerts (engineering/testing oriented)
61 +
62 +- **Alerts → SIEM** → `/alerts/siem`
63 + - SIEM-centric alert view (Graylog-backed in current routing).
64 +
65 +- **Alerts → MITRE ATT&CK** → `/alerts/mitre`
66 + - ATT&CK mapping view.
67 +
68 +- **Alerts → Atomic Red Team** → `/alerts/atomic-red-team`
69 + - Adversary simulation / test harness view.
70 +
71 +### Artifacts
72 +
73 +- **Artifacts** → `/artifacts`
74 + - Evidence, files, and investigation artifacts.
75 +
76 +### Customers
77 +
78 +- **Customers** → `/customers`
79 + - Multi-tenant/customer context management.
80 + - Deep links:
81 + - `/customers?code=<customer_code>`
82 + - `/customers?action=add-customer`
83 +
84 +### Agents (endpoint-facing capabilities)
85 +
86 +- **Agents → Agents list** → `/agents`
87 +- **Agents → Groups** → `/agents/groups`
88 +- **Agents → Sysmon Config** → `/agents/sysmon-config`
89 +- **Agents → Detection Rules** → `/agents/detection-rules`
90 +- **Agents → CoPilot Actions** → `/agents/copilot-actions`
91 +- **Agents → Vulnerability Overview** → `/agents/vulnerability-overview`
92 +- **Agents → Patch Tuesday** → `/patch-tuesday` *(note: defined under Agents menu, but route is top-level)*
93 +- **Agents → SCA Overview** → `/agents/sca-overview`
94 +
95 +### Report Creation
96 +
97 +- **Report Creation → General Reports** → `/report-creation/general`
98 +- **Report Creation → Vulnerability Reports** → `/report-creation/vulnerability-reports`
99 +- **Report Creation → SCA Reports** → `/report-creation/sca-reports`
100 +
101 +### Healthcheck
102 +
103 +- **Healthcheck** → `/healthcheck`
104 + - Health/status style overview (commonly used by admins/operators to confirm stack state).
105 +
106 +### Indices (admin/ops)
107 +
108 +- **Indices → Index Management** → `/indices/management`
109 + - Deep link supports `?index_name=<name>`.
110 +
111 +- **Indices → Snapshot & Restore** → `/indices/snapshots`
112 +
113 +### Graylog (admin/ops)
114 +
115 +- **Graylog → Management** → `/graylog/management`
116 + - Supports hash navigation to tabs (example):
117 + - `/graylog/management#streams`
118 + - `/graylog/management#inputs`
119 + - `/graylog/management#events`
120 +
121 +- **Graylog → Metrics** → `/graylog/metrics`
122 +
123 +- **Graylog → Pipelines** → `/graylog/pipelines`
124 + - Supports `?rule=<something>` for jumping to a pipeline rule.
125 +
126 +### Connectors (admin/engineer)
127 +
128 +- **Connectors** → `/connectors`
129 + - Configure and validate connections to underlying stack services.
130 +
131 +### External Services (admin/engineer)
132 +
133 +- **External Services → 3rd Party Integrations** → `/external-services/third-party-integrations`
134 +- **External Services → Network Connectors** → `/external-services/network-connectors`
135 +- **External Services → Singul App Auth** → `/external-services/singul-app-auth`
136 +
137 +### Scheduler
138 +
139 +- **Scheduler** → `/scheduler`
140 + - Job scheduling / automation.
141 +
142 +### Customer Portal
143 +
144 +- **Customer Portal** → `/customer-portal`
145 + - Customer-facing portal view.
146 +
147 +---
148 +
149 +## Suggested mental model (helps teams onboard)
150 +
151 +- **Operators**:
152 + - live in *Incident Management* and only dip into *Artifacts* and *Customers* as needed.
153 +
154 +- **Admins/Engineers**:
155 + - spend time in *Connectors*, *External Services*, *Graylog*, and *Indices* to ensure the pipeline is healthy.
156 +
157 +- **Detection engineering / testing**:
158 + - *Alerts (MITRE/Atomic Red Team)* + *Agents (Rules/Sysmon)* + *Scheduler*.
mkdocs.yml
+1
@@ -76,6 +76,7 @@ nav:
76 - Quickstart (Operators): user/operators-quickstart.md
77 - Quickstart (Admins/Engineers): user/admins-quickstart.md
78 - Features by Area: user/features.md
79 + - Navigation Guide (UI): user/navigation.md
80 - Videos (Playlist): user/videos.md
81 - Developer / AI Agent Docs:
82 - Start Here: developer/start-here.md