# SOC Copilot

> SOC Copilot is Oyster's case-based investigation workbench — attach evidence, run Sigma and YARA detections, analyse network captures, build a timeline, map to MITRE ATT&CK and export a report.

Source: https://documentation.redorca.ai/guides/blue-team/soc-copilot/
Last updated: 2026-11-01

SOC Copilot is a workbench for investigations. You open a case, attach the evidence you have, and work through it in one place, with an AI assistant beside you. It needs an account; open **SOC Copilot** under **Blue Team**.

## Cases

The dashboard lists your cases with their status. **Create** a case for each investigation. Inside a case, the tabs are:

| Tab | What it does |
|---|---|
| **Overview** | Summary, status and key facts of the case. |
| **Evidence** | Attach files, and analyse Windows logs and YARA matches. |
| **Detections** | Sigma and YARA matching over the evidence. |
| **Network** | Packet captures (PCAP), Zeek and Suricata EVE data. |
| **Timeline** | Events in order across the evidence. |
| **IOCs** | Indicators of compromise extracted from the evidence. |
| **MITRE** | Observed activity mapped to MITRE ATT&CK techniques. |
| **Correlation** | Related events and entities, linked. |
| **Graph** | Entities grouped and connected. |
| **Coverage** | Which techniques your detections cover, and telemetry gaps. |
| **Playbooks** | Attach a playbook template and work through its steps. |
| **Dispositions** | Record what each item turned out to be. |
| **Notes** | Your notes on the case. |
| **AI Assistant** | Ask about the case. |
| **Report** | Export the investigation as Markdown or PDF. |

## Rule Authoring

**Rule Authoring**, in the view switcher at the top, drafts a detection for **Sigma**, **Splunk SPL**, **Elastic KQL** and **ES|QL** from a one-line description of what you want to catch — for example "PowerShell spawning from Office with an encoded command". Treat a generated rule as a draft: test it against your own data before you deploy it.

## Evidence that gives real results

SOC Copilot analyses real telemetry: Windows event logs (EVTX or JSON), Zeek logs, Suricata EVE JSON and PCAP files. Plain text without that structure gives empty analyses — honestly empty, not invented.

## Privacy

Every account has its own SOC Copilot database. No other account can see your cases, evidence or reports. See [Isolation](https://documentation.redorca.ai/understand/isolation/).

:::note
**Live SIEM** — searching a live Splunk or Elastic deployment from inside SOC Copilot — is reserved for Red Orca's own operators and is not offered to accounts. Export what you need from your SIEM and attach it as evidence instead.
:::