SOCFortress CoPilot Documentation
CoPilot is a single pane of glass for operating an open‑source SOC/SIEM stack (Wazuh, Graylog, Velociraptor, Grafana, Shuffle, and more). Choose your path:Start here
Guided path: ingest → dashboards → alerts → cases → response.
SOC Operator / Analyst
Alert triage → cases → investigations.
Admin / Engineer
Configure sources, connectors, and integrations.
Developer / AI Agent
Architecture, data flows, schema, and safe change playbooks.
If the animation doesn’t autoplay in your browser, click once to start playback.
Popular tasks
Provision a customer
Create a tenant and set up the minimum required configuration.
Add integrations & connectors
Connect third‑party sources and external network connectors.
Triage an alert → open a case
Start from an alert and manage work in a case.
Manage indices
Validate index patterns, retention, and troubleshooting.
Browse the UI Guide
Documentation that mirrors the CoPilot menu.
Video library (summarized)
Watch the playlist like docs: links + structured bullets (no transcripts stored).
Get oriented
1
Start with a quickstart
Operators: start with the Operator quickstart. Admins/engineers: start with the Admin/Engineer quickstart.
2
Use the UI Guide for day-to-day workflows
The UI Guide mirrors the menu so people can find what they see in the product.
3
Use videos as supplemental walkthroughs
The Videos page summarizes the full playlist into skimmable sections.