SOC Copilot

SOC Copilot is a workbench for investigations. You open a case, attach the evidence you have, and work through it in one place, with an AI assistant beside you. It needs an account; open SOC Copilot under Blue Team.

Cases

The dashboard lists your cases with their status. Create a case for each investigation. Inside a case, the tabs are:

Tab	What it does
Overview	Summary, status and key facts of the case.
Evidence	Attach files, and analyse Windows logs and YARA matches.
Detections	Sigma and YARA matching over the evidence.
Network	Packet captures (PCAP), Zeek and Suricata EVE data.
Timeline	Events in order across the evidence.
IOCs	Indicators of compromise extracted from the evidence.
MITRE	Observed activity mapped to MITRE ATT&CK techniques.
Correlation	Related events and entities, linked.
Graph	Entities grouped and connected.
Coverage	Which techniques your detections cover, and telemetry gaps.
Playbooks	Attach a playbook template and work through its steps.
Dispositions	Record what each item turned out to be.
Notes	Your notes on the case.
AI Assistant	Ask about the case.
Report	Export the investigation as Markdown or PDF.

Rule Authoring

Rule Authoring, in the view switcher at the top, drafts a detection for Sigma, Splunk SPL, Elastic KQL and ES|QL from a one-line description of what you want to catch — for example “PowerShell spawning from Office with an encoded command”. Treat a generated rule as a draft: test it against your own data before you deploy it.

Evidence that gives real results

SOC Copilot analyses real telemetry: Windows event logs (EVTX or JSON), Zeek logs, Suricata EVE JSON and PCAP files. Plain text without that structure gives empty analyses — honestly empty, not invented.

Privacy

Every account has its own SOC Copilot database. No other account can see your cases, evidence or reports. See Isolation.

Note

Live SIEM — searching a live Splunk or Elastic deployment from inside SOC Copilot — is reserved for Red Orca’s own operators and is not offered to accounts. Export what you need from your SIEM and attach it as evidence instead.