The lab

Where events start, and the rules that turn them into alerts.

• Wazuh agentendpoint collection

  Reads the Windows and Linux events I choose and ships them to the manager. Collection is a list I tune, not everything the machine logs.

  Reference architectureWazuh architectureEvents to a case

• Wazuh managerdetection engine

  Decodes agent data and applies rules. A rule match becomes an alert with a level, a rule ID and the fields that matched.

  Reference architectureWazuh architecture

• Wazuh Indexersearch and storage · OpenSearch

  Stores and indexes alerts. CoPilot reads alerts from here, so this is where a count in CoPilot should match the source.

  Reference architectureWazuh architecture

• Wazuh DashboardWazuh interface

  Wazuh’s own investigation and admin views. CoPilot does not replace every native console.

  Reference architectureWazuh architecture

• Windows Security logsource · 4624, 4625, 4728

  The audit events my AD lab produces. I monitored these on domain-joined machines; the audit policy decides which ones exist at all.

  In my labAD labA Windows logon

• Sysmonsource · process and network

  Adds process creation, network connection and persistence events that the Security log does not carry. It also adds volume, so it gets tuned first.

  Reference architectureSysmon docs

• Linux sourcessource · auth, audit, apps

  Authentication, audit and application logs from the containers, collected selectively.

  Reference architectureWazuh architecture

• Proxmox servicessource · host and guests

  The hypervisor and its guests. Host monitoring is added carefully, after measuring what it costs the laptop.

  In my labFollow a packet

• Sophos Firewallsource · firewall, IPS, ATR

  Gateway for the LAN and all seven VLANs. Its allow, drop, IPS and threat-feed events are the network half of the story.

  In my labPolicy orderATR snapshot

• Defender Antiviruslocal malware protection

  Built into Windows and protects the local machine. It is not EDR and not a SIEM.

  Reference architectureDefender Antivirus

• Defender for EndpointEDR · explored on a trial

  Enterprise endpoint security whose features depend on the plan. I explored it on a free trial. Wazuh complements it; it does not replace it.

  In my labDefender and SplunkDefender SIEM integration

• Defender XDRcross-product incidents

  Correlates alerts from licensed Microsoft security products into incidents. Which data it has depends on what is licensed and enabled.

  Reference architectureDefender SIEM integration

Where alerts become cases, and where I go for more evidence.

• Graylogsyslog ingestion and parsing

  Receives Sophos syslog on its own input and parses source, destination, action, rule and service, so a firewall drop becomes searchable fields.

  Reference architectureSOCFortress docs

• SOCFortress CoPilotSOC workspace · alerts and cases

  The centre of the stack: one queue for alerts from Wazuh and Graylog, cases, and the integrations that reach the other tools. It is the screen I would start every investigation from.

  Reference architectureCoPilot sourceSOCFortress docsSOC-0142 case

• Velociraptorforensic collection

  Runs targeted collections on an endpoint when a case needs more than logs: running processes, autoruns, a file’s hash.

  Reference architectureSOCFortress docs

• Grafanadashboards

  Trends and stack health. A dashboard shows a pattern; the case still needs the events behind it.

  Reference architectureSOCFortress docs

• InfluxDBtime series

  Stores the metrics behind health dashboards when configured.

  Reference architectureSOCFortress docs

What adds context to a case, and the gate before anything changes.

• Shuffle SOARworkflows · approval gate

  Runs the playbook: fetch the alert, enrich indicators, update the case, and stop at an approval step before any response action.

  Reference architectureSOCFortress docsApproval gate

• SOCFortress Threat Intelindicator enrichment

  Enriches Wazuh or Graylog events through the SOCFortress service. Needs service access and an API key.

  Reference architectureThreat Intel integration

• SOCFortress UBAuser behaviour analytics

  A separate component that analyses selected behaviour events and raises alerts into the same workflow.

  Reference architectureUBA deployment

• TalonAI-assisted investigation

  Investigates supported CoPilot alerts with connected tools and writes findings back. Availability, privacy and model cost come before turning it on.

  Reference architectureSOCFortress docs

• OpenCTIthreat intelligence platform

  Structured intelligence and indicator enrichment in supported versions.

  Reference architectureSOCFortress docs

• Jev decision stepbounded recommendation

  In my AI-assisted example, Jev reads the gathered evidence and proposes one disposition with a confidence level. It cannot act; the analyst decides.

  Reference architectureSOC-0142 case

The separate search environment and the plumbing the stack runs on.

• Splunkseparate SPL investigations

  A second place to search selected data with SPL. Splunk Free indexes up to 500 MB a day and has no alerting, so cases stay in CoPilot.

  In my labSplunk and DefenderSplunk Free

• Docker / Composehow the stack runs

  The reference stack ships as containers, which keeps each service’s version and settings in one file.

  Reference architectureOSSIEM reference

• MySQLCoPilot database

  Holds CoPilot’s cases, customers and settings. Backed up with the cases, because losing it loses the history.

  Reference architectureCoPilot source

• MongoDBGraylog configuration

  Stores Graylog’s inputs, streams and pipelines, not the log messages themselves.

  Reference architectureSOCFortress docs

• MinIOobject storage

  S3-compatible storage for artifacts and files the stack keeps, such as forensic collections.

  Reference architectureCoPilot source

• Fluent Bitlog shipper

  A light shipper that forwards logs from sources without their own agent.

  Reference architectureSOCFortress docs

• Filebeatlog shipper

  Ships files such as alert JSON from one service into the next.

  Reference architectureSOCFortress docs

• Reverse proxy and trusted TLSprotects management UIs

  Management interfaces stay private, behind a proxy with a trusted certificate and certificate checks on, never published to the internet.

  Reference architecturePrivate access

• MCP and API accesshow agents reach tools

  Read-only API credentials let an AI agent gather context. Separate least-privilege accounts, rotated secrets, no write scopes by default.

  Reference architectureCoPilot source

• Defender incident API · Event Hubsreference integration paths

  Microsoft documents incidents into Splunk through its add-on, and event streaming through Azure Event Hubs. Licences and versions are checked before either.

  Reference architectureDefender SIEM integration