Getting StartedTalon Studio v1.0.2-beta

Introduction

Talon Studio is a detection-engineering platform you run yourself: one container image on your own infrastructure, in beta, running as the Community Edition on the key that comes with your Talon Labs account. It turns detection into code, on top of the SIEMs you already run.

Connect. Author. Validate. Deploy.

Talon Studio folds the whole detection lifecycle into one workflow. Connect a SIEM and introspect its evidence, author detections as code in Forge, validate them in Monitor, and ship through the release pipeline — without leaving the platform or ripping out the tooling you already pay for.

Detections are portable Sigma — or native SIEM queries — stored as Git-backed YAML and validated against real telemetry before they ship. Edits go through change requests, and a Sigma rule written once is converted to the target SIEM's query language when it deploys.

Sigma — AWS root account console login

# Flag any interactive console login from the AWS root account

title: AWS Root Account Console Login

logsource:

  product: aws

  service: cloudtrail

detection:

  selection:

    eventName: ConsoleLogin

    userIdentity.type: Root

  condition: selection

level: high

In the workspace repository that rule lives in one YAML file per detection, named for its ATT&CK technique, inside Talon's envelope: the name, ATT&CK mapping and severity, a queries block with a slot for each language (splunk, sentinel, elastic, sigma, yara_l), and the detection's validation and deployment state.

Where to next?

New to Talon Studio? These are the fastest paths in.

Quickstart Stand up the Talon Studio appliance and ship your first detection in minutes.Connect a SIEM Introspect Splunk, Sentinel, Elastic or Chronicle and build your Evidence Grid.Author a detection Write Sigma or a native SIEM query in Forge with live translation to your SIEM's query language.Deploy a detection Ship through the release pipeline with convert-on-deploy and one-click rollback.

The Talon platform

Talon Studio is built around a single idea: your detections should live in code, be tested like software, and deploy like infrastructure. Everything is organised into products — Connect, Atlas, Forge, Monitor, Replay, Threat, SOC, Search, Flow and Claw — that share one Git-backed source of truth.

Use the sidebar to jump into any product. Each guide covers what it is, how it works, how to set it up, and how to use it.

The Community Edition

Talon Studio runs as the Community Edition on the Community key that comes with your Talon Labs account, under the Talon Labs Community Edition Licence. It costs nothing, and it is not open source. Without a key, Studio shows only the key screen.

Community

The Community key from your Talon Labs account; no charge. Every product in these docs, with limits: 2 users, 1 workspace, 1 SIEM connection, 1 deployment target, deploys from main only, and 2 read-only API tokens. Detections and branches are unlimited.

Enterprise

A signed key from Talon Labs. In development, and not on sale. It lifts the Community limits and adds OIDC SSO, federated search, the SOC org console, ServiceNow ticketing, curated content packs, API write scopes and the outbound MCP server.

A key is verified on your server against a public key built into the image; a Community key never contacts Talon Labs. An Enterprise key that expires or is revoked returns the instance to the Community Edition, with nothing deleted. A stored key that stops verifying or decrypting shows the key screen until an admin pastes a valid one. Licensing has the detail.

Open by design

Talon Studio speaks the formats your team already uses. Detections are portable Sigma and native SIEM queries stored as Git-backed YAML you can clone, the whole platform is one container image on infrastructure you own, and there is a REST API under /api/v1 (read-only tokens on the Community Edition) — so your detection programme is never locked in.

SigmaSPL / KQL / EQL / YARA-LGitYAMLDockerMITRE ATT&CK

Tip

Connect a SIEM before you start authoring — /connect/siem introspects your real indexes, sourcetypes, and fields, so Atlas coverage and Forge translation reflect telemetry you actually have rather than a theoretical catalogue.