CoPilot

Why we included this project

CoPilot from SOCFortress is a self-hosted platform that consolidates the day-to-day work of running an open-source security operations stack. Instead of bouncing between Wazuh, Graylog, Velociraptor, Grafana, and Shuffle, you get a single UI for triaging alerts, chaining them into investigation cases, pulling DFIR evidence with Velociraptor artifacts, and managing endpoint agents. It also handles the behind-the-scenes admin work, including multi-tenant data onboarding, connectors, and event-source normalization, which matters for managed-security providers or internal SOCs that need to keep multiple customers and telemetry streams flowing. An optional AI analyst module adds assisted triage and reporting on top of that core loop. Teams already invested in open-source security tooling will find this cuts a lot of glue work and gives operators and engineers one shared workflow, and installing via Docker Compose keeps the setup straightforward.