Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.socfortress.co/llms.txt

Use this file to discover all available pages before exploring further.

CoPilot can run Scout Suite scans and surface the resulting report inside the UI. Scout Suite is an open-source cloud security assessment tool that scans a cloud account via provider APIs, identifies risky configurations, and generates a report with remediation guidance.

​
Why this is a power feature

Cloud posture assessment is not required for the initial SIEM bring-up, but it becomes valuable once your core pipeline is healthy. Use it for:
  • periodic cloud posture reviews (monthly/quarterly)
  • identifying misconfigurations and risky exposures
  • producing a shareable “here’s what to fix next” report for stakeholders

​
How it works in CoPilot (high level)

  1. You create cloud credentials with read-only assessment permissions (provider-specific)
  2. In CoPilot, you create a new cloud assessment report
  3. CoPilot runs Scout Suite in the background
  4. When complete, the report is listed and can be opened/viewed in CoPilot

​
Supported providers

  • AWS
  • Azure
  • Google Cloud (GCP)
CoPilot can run Scout Suite scans for these providers as long as the appropriate credentials and API permissions are in place.

​
Setup checklist (AWS / Azure / GCP)

​
1) Create a dedicated Scout Suite cloud principal

Create a dedicated identity for assessments:
  • AWS: IAM user/role
  • Azure: App registration / service principal
  • GCP: service account
Guidance:
  • Use least privilege.
  • Prefer read-only where possible.
Provider-specific credential setup (recommended):

​
2) Generate credentials

Create the credentials required for the provider you’re scanning. Common patterns from the Scout Suite wiki:
  • AWS: standard AWS credential sources (profiles in ~/.aws/credentials, environment variables, role assumption, or explicit access keys)
  • Azure: Azure CLI login, user-account browser login (MFA-friendly), or service principal (including file-based SDK auth)
  • GCP: application-default user credentials or a service account key JSON

​
3) Run the scan in CoPilot

In CoPilot:
  1. Open Cloud security assessment
  2. Select provider type (AWS / Azure / GCP)
  3. Set a report name
  4. Enter credentials
  5. Submit
The scan runs in the background. Runtime depends on the size of the cloud environment. Operational tip (from the video):
  • You can tail CoPilot container logs to see when report generation completes.
  • Use Refresh in the UI; when done, the report appears in the list.

​
Success criteria

  • You can create a report and the scan completes
  • The report shows in the UI after refresh
  • The report content is accessible to authorized users

​
Safety / guardrails

  • Cloud posture reports can contain sensitive inventory details (accounts, resources, IAM relationships).
    • Restrict access (RBAC) appropriately.
  • Use dedicated credentials and rotate them.
  • Avoid storing long-lived keys if your environment supports roles/short-lived credentials.

​
Troubleshooting

  • Report never appears:
    • confirm credentials are valid
    • confirm required API permissions exist
    • check CoPilot container logs for Scout Suite errors
  • Report takes a long time:
    • large environments can take longer to enumerate
    • rerun during a quieter window

​
Video context

Walkthrough + setup: