> ## Documentation Index
> Fetch the complete documentation index at: https://docs.socfortress.co/llms.txt
> Use this file to discover all available pages before exploring further.

# What is CoPilot?

> CoPilot is a single pane of glass for operating and integrating an open-source SOC/SIEM stack.

SOCFortress CoPilot is a **single pane of glass** for operating an open‑source SOC/SIEM stack.

It sits above tools like **Wazuh**, **Graylog**, **Velociraptor**, **Grafana**, and **Shuffle** and helps you:

* **Operate incidents**: alerts → cases → evidence → response
* **Onboard data**: customer/tenant provisioning, integrations, and connectors
* **Reduce context switching** with a consistent UI and workflow

<Frame>
  <div style={{ width: '100%', maxWidth: 1100, margin: '0 auto' }}>
    <video
      autoPlay
      loop
      muted
      playsInline
      preload="auto"
      controls={false}
      disablePictureInPicture
      onClick={(e) => e.currentTarget.play()}
      style={{
    width: '100%',
    aspectRatio: '16 / 9',
    height: 'auto',
    display: 'block',
    borderRadius: 16,
    background: 'rgba(0,0,0,0.2)',
  }}
    >
      <source src="https://mintcdn.com/socfortressllc/AThv2mEBHxCpLZOQ/assets/hero/copilot-hub.webm?fit=max&auto=format&n=AThv2mEBHxCpLZOQ&q=85&s=fa30d63f5cd6670c0c2e697b2f00617f" type="video/webm" data-path="assets/hero/copilot-hub.webm" />

      <source src="https://mintcdn.com/socfortressllc/AThv2mEBHxCpLZOQ/assets/hero/copilot-hub.mp4?fit=max&auto=format&n=AThv2mEBHxCpLZOQ&q=85&s=d15cbd8cccd53adc1de50d39f8e2f13d" type="video/mp4" data-path="assets/hero/copilot-hub.mp4" />
    </video>
  </div>
</Frame>

<div style={{ fontSize: 13, opacity: 0.8, marginTop: 8 }}>
  If the animation doesn’t autoplay in your browser, click once to start playback.
</div>

## Who is it for?

<Columns cols={3}>
  <Card title="SOC operators / analysts" icon="siren">
    Daily triage and case work.
  </Card>

  <Card title="Admins / engineers" icon="gear">
    Data onboarding, integrations, indices, and reliability.
  </Card>

  <Card title="Developers" icon="code">
    Extend CoPilot safely (connectors, schema changes, data flows).
  </Card>
</Columns>

## The mental model

Think of CoPilot as two loops:

1. **Incident loop** (operator): detect → triage → investigate → contain
2. **Ingestion loop** (admin): connect → route → normalize → validate

Next: read [Roles & mental model](/getting-started/roles-and-mental-model) and then pick a quickstart.