Skip to content
DocumentationAPI ReferenceChangelog
API ReferenceTalon Studio v1.0.6-beta

Library

Search the synced detection content library, and read a rule with its queries ready to propose.

Search the library

GET/api/v1/librarylibrary:read

Search one source of the synced detection library by name or technique. Reference data — it takes no workspaceId. To adopt a rule, read it with GET /library/{source}/{id} and pass its query to POST /detections, which opens a change request.

Query parameters
sourcestring · optional
splunk (Splunk security content) | sigma | kql (Microsoft Sentinel) | yaral (Google SecOps YARA-L) | ff_kql (FalconFriday) | elastic. Default sigma; any other value returns 422.
searchstring · optional
Matched case-insensitively within each rule's name and description — for Sigma also its file path, status and level, for Splunk its technique id and name. Cut to 200 characters.
techniquestring · optional
Sigma only: an ATT&CK id matched within the rule's technique list, so T1059 also finds T1059.001. Cut to 32 characters; ignored for other sources.
pageinteger
Page number, default 1.
perPageinteger
Items per page, 1–50, default 25.
Response
sourcestring
idstring
The rule's id in its source — pass it to GET /library/{source}/{id}.
titlestring
descriptionstring · nullable
mitreTechniqueIdstring · nullable
The rule's first technique.
mitreTacticstring · nullable
confidenceOrLevelstring · nullable
The source's own rating: Splunk confidence, Sigma level (or status), the severity of a Sentinel, Google SecOps or Elastic rule; null for FalconFriday.
tagsstring[]
Sigma tags, Sentinel tactics, the Google SecOps platform, FalconFriday OS tags or Elastic integrations; empty for Splunk.
filePathstring · nullable
The rule's path in its source repository; null for Splunk.
lastSyncedAtstring (ISO 8601)
Returned with meta { page, perPage, total, totalPages } and links { next, prev }, ordered by name. A source the instance hasn't synced returns an empty page.
Request
curl -H "Authorization: Bearer tlk_…" \
  "https://<your-instance>/api/v1/library?source=sigma&technique=T1059.001"
Response
{
  "data": [
    {
      "source": "sigma",
      "id": "3b1c…",
      "title": "Suspicious PowerShell Download",
      "description": "Detects PowerShell downloading a payload with Net.WebClient.",
      "mitreTechniqueId": "T1059.001",
      "mitreTactic": null,
      "confidenceOrLevel": "medium",
      "tags": ["attack.execution", "attack.t1059.001"],
      "filePath": "rules/windows/powershell/…/….yml",
      "lastSyncedAt": "2026-10-26T02:00:00.000Z"
    }
  ],
  "meta": { "page": 1, "perPage": 25, "total": 1, "totalPages": 1 },
  "links": { "next": null, "prev": null }
}

Get a library rule

GET/api/v1/library/{source}/{id}library:read

One library rule in full: its query in its own language and, for a Sigma rule, the pre-rendered conversion to each SIEM — ready to pass to POST /detections.

Path parameters
sourcestringrequired
splunk | sigma | kql | yaral | ff_kql | elastic
idstringrequired
The rule's id from GET /library.
Response
dataobject
Every field GET /library returns, plus the ones below.
data.splQuerystring · nullable
Splunk rules.
data.sigmaRulestring · nullable
The Sigma YAML: a Sigma rule's own (also in ruleYaml), or the Sigma a Splunk rule ships with.
data.kqlQuerystring · nullable
Sentinel and FalconFriday rules.
data.yaralRulestring · nullable
Google SecOps rules.
data.elasticQuerystring · nullable
Elastic rules, in elasticLanguage (eql | kuery | lucene | esql); elasticConfig is the x_elastic the rule is adopted with.
data.conversionsobject · nullable
Sigma rules only: the pySigma conversion for each target — splunk, sentinel, elastic, chronicle — with null where a backend can't express the rule.
data.logsourceobject · nullable
Sigma rules only.
data.mitreTechniqueIdsstring[]
data.mitreTechniquesobject[]
{ id, name } for each technique, from the synced ATT&CK catalogue, with mitreTactics[] and mitreThreatGroups[] alongside.
data.referencesstring[]
data.falsePositiveNotesstring · nullable
data.dataSourcesstring[]
The data the rule reads; index patterns for an Elastic rule.
data.requiredSourcetypesstring[]
Returned as { data: { … } }. Splunk rules also carry requiredFields, dataModel, analyticStory, observables, riskScore, riskMessage, detectionTypeRaw, assetType, securityDomain and tests; other sources return those empty or null, except an Elastic rule's riskScore. An unknown source or id returns 404 "Library rule not found". To adopt the rule, send its query to POST /detections — sigmaRule as sigma, splQuery as spl, kqlQuery as kql, yaralRule as yaraL, elasticQuery as eql with elasticLanguage — so adoption still goes through a change request.
Request
curl -H "Authorization: Bearer tlk_…" \
  "https://<your-instance>/api/v1/library/sigma/{id}"
Response
{
  "data": {
    "source": "sigma",
    "id": "3b1c…",
    "title": "Suspicious PowerShell Download",
    "mitreTechniqueId": "T1059.001",
    "confidenceOrLevel": "medium",
    "sigmaRule": "title: Suspicious PowerShell Download\n…",
    "conversions": {
      "splunk": "…",
      "sentinel": "…",
      "elastic": "…",
      "chronicle": null
    },
    "mitreTechniques": [{ "id": "T1059.001", "name": "PowerShell" }],
    "references": []
  }
}