No hardware?
Rent the box. Keep the data.
Talon Studio is an appliance you host. If you have nowhere to host it, a €4 VPS is enough — and every file you need to set one up is on this page. The key that runs it comes with a free Talon Labs account.
Three routes to the same running instance.
Not three steps — three alternatives. They end in the identical appliance, and differ only in what you already have. If you are choosing rather than confirming, take the first.
BEFORE ANY ROUTE
Get your Community key. Talon Studio needs a Talon key to run, and every route below ends on the screen that asks for it. The free Community key comes with a Talon Labs account — create one, or copy it from your account if you have one.
In beta, and public. Talon Studio is in beta. Its image is public, so no route below stops at the pull.
Paste a bootstrap
~15 minYou have a cloud account and no strong opinion about tooling.
curl -fsSL https://www.talonlabs.dev/studio/cloud-init.yaml -o studio-cloud-init.yaml
Leave a placeholder in and it stops with a message naming it, rather than booting half-configured.
Apply Terraform
~20 minYou already run Terraform and want this in the same state file.
module "talon" {
source = "https://www.talonlabs.dev/studio/terraform/vm-aws.tar.gz"
}Four shapes: vm-aws, vm-azure, kubernetes-aws, kubernetes-azure.
Install a chart
~10 minYou have a cluster already and your policy says it runs there.
helm repo add talon https://www.talonlabs.dev/charts
Each chart refuses to render above one replica, on purpose. See below.
Every URL above is a plain file this site serves, so reading them needs no GitHub account and no registry login. Read before you run: the sources are in the Talon Deploy repository, the bootstrap is commented plain text, and deploy-manifest.json carries a SHA-256 for each one so you can check what you downloaded is what we published.
Four places to rent one machine.
Any of them runs Talon Studio on 2 vCPU and 4 GB. The difference is price and how much of the box you want to look after. Prices checked September 2026, and they move.
Hetzner Cloud
€4–9/moThe cheapest thing that properly works. A CX22 runs it comfortably.
- Set-up
- Paste our cloud-init into the user-data box
- OS
- Yours to patch
The catch: You patch the OS and arrange your own backups — call it an hour a month.
Hetzner CloudDigitalOcean
$24/moThe same shape as Hetzner, with a console more people already know.
- Set-up
- Paste our cloud-init into the user-data box
- OS
- Yours to patch
The catch: Several times Hetzner's price for the same specification.
DigitalOceanRailway
$20–30/moOne image and a volume, and no server to log into.
- Set-up
- Deploy the public image, attach a volume
- OS
- Managed for you
The catch: Usage-based billing, so the number moves with what you run.
RailwayRender
$30–45/moThe service, its disk and a managed database, looked after for you.
- Set-up
- An image-backed service with a disk
- OS
- Managed for you
The catch: The most expensive option here, and it does not scale to zero.
RenderWhy nothing serverless is listed. Talon Studio runs its scheduler inside the web process and writes to a real disk. A platform that freezes the process between requests runs no content sync, no validation and no scheduled work — so functions-as-a-service hosting is out, and every option above is a container that stays running with a volume that survives a restart.
What actually happens when you run it.
Worth knowing before you paste a file into a machine you are about to trust with your detections.
Paste a bootstrap
cloud-init is the thing every provider already runs on first boot — the box labelled “user data” when you create a server. Fill in the four placeholders in your product’s file, paste it in, and the machine installs Docker, locks the firewall to SSH and HTTPS, gets a TLS certificate, generates your secrets and starts the appliance. Nothing to install locally.
Apply Terraform
Terraform takes an HTTP archive as a module source, so there is nothing to clone. The VM stacks build the network, the instance and the DNS, then hand it the same cloud-init as the paste route — so the two cannot drift. The Kubernetes stacks build EKS or AKS with a managed Postgres and install the chart.
Install a chart
A Helm repository is an index and a tarball over HTTPS — no registry, no login, nothing to authorise. Add it, and `helm search repo talon` lists the charts. The chart creates the deployment, the service, the ingress and the volume.
One replica
Talon Studio is a single-writer appliance. The login and MFA throttles count in-process with no shared store, scheduled work would double-fire, the event bus is per-process, and the data volume is ReadWriteOnce. Two replicas is not a scaled deployment, it is a broken one — so the chart refuses to render above one rather than letting the topology look sanctioned. Scale the node, not the deployment.
Talon Studio
The detection engineering platform — ATT&CK coverage, detections as code, shipped to your SIEM through Git.
One container: the app, an embedded Postgres and the Sigma converter, on one /data volume. Nothing else to provision.
A DNS record, a server and one file.
A €4 server, one pasted file, and the Community key from your account. The encryption key the bootstrap prints is the one thing you must copy off the box; everything else can be rebuilt.