AdministrationTalon Studio v1.0.2-beta

Integrations

Route Talon Studio events — validation failures, coverage gaps, pipeline breaks — to Slack and Microsoft Teams, filtered by event, severity, workspace and branch.

What it is

Settings → Integrations (/settings/integrations, admin only) routes Talon Studio notifications to your team's chat. Two providers are supported — Slack and Microsoft Teams — both over incoming webhooks. You can register several destinations and choose exactly which events reach each one. SOC case notifications (assignment, status, disposition, resolution and comments) are routed separately, from the SOC settings page.

Events & filters

A destination subscribes to any of these events, listed as they appear under Notify on:

Pipeline failures

Failed jobs, checks or automation.

Validation failures

Detection tests that fail or degrade.

Coverage gaps

New ATT&CK or stream coverage gaps.

Coverage drift

Data source or field quality drift.

Deploy failures

SIEM packaging or release push failures.

Release blocked

Gates that stop a release.

Content sync

Library and source sync results.

Branch pushes

Commits and merges landing on a branch.

Workboard moves

Cards changing columns, including approved proposals.

Threat intel

New KEV CVEs and ransomware-linked threats.

SIEM connection health

A connected SIEM goes down or recovers.

Change request assigned

Someone is assigned as reviewer on a change request.

SOC cases

A high-severity alert is promoted to a SOC case.

System notices

Test messages and platform notices, including MCP approval requests and password-reset requests.

Then filters decide whether a matching event is delivered, and how it looks:

Minimum severity

Info+, Success+, Warning+ (the default) or Critical. Only events at or above it are sent.

Workspaces

Empty means all workspaces. Otherwise only events from the chosen workspaces are sent; events with no workspace — threat intel, system notices — are always delivered.

Branches

Applies to branch pushes only. Empty means every branch; otherwise only pushes to the listed branches.

Card style

Detailed or compact.

Include details / Include action link

Whether the card carries the event's fields and a link back into Talon.

Enabled

Switch a destination off without deleting it.

Each destination's webhook URL and filters are stored together, encrypted at rest. On each event, Talon sends to every enabled destination whose filters match, and records the result on the destination's card as its last test or last error.

Defaults. A new destination starts with six events selected: pipeline failures, validation failures, coverage gaps, coverage drift, deploy failures and release blocked. Everything else, including System notices, must be switched on.

Send test message bypasses every filter — events, severity, workspace and branch — so the test always arrives, whatever the destination's policy.

Approval requests need System notices

Agent-proposed MCP actions and forgotten-password requests notify as System notices at warning severity, which no destination receives by default. Switch System notices on for a channel your admins watch, or approval requests will sit unnoticed in the MCP actions queue.

Setup

In Slack or Teams, create an incoming webhook and copy its HTTPS URL.

Open Settings → Integrations and click Add destination. Pick Slack or Microsoft Teams, give it a Name (up to 80 characters) and paste the Webhook URL.

Choose the events under Notify on, the Minimum severity, and optionally the workspaces and branches.

Save, then use the card's Send test message action and watch the channel to confirm.

Settings → Integrations

The Add destination dialog — pick Slack or Microsoft Teams, paste the webhook URL, then choose events, minimum severity, workspaces and card style. After saving, post a sample with the card's Send test message action.

Webhook requirements

Webhook URLs must be HTTPS, can't embed credentials, and are checked against a private/internal-host SSRF guard before they're saved. Delivery has a hard 10-second timeout, so a stalled channel can't hang the sender. When you edit a destination, leave the webhook field blank to keep the stored URL.

Tip

Start with a high minimum severity (Warning+ or Critical) and scope to the workspaces a channel actually owns — it's the difference between an alerting channel people watch and one they mute. Add a second, chattier destination for Content sync if you want it.