API ReferenceTalon Studio v1.0.6-beta

Proposals

Read Talon Claw's suggested detections for a workspace.

List proposals

GET/api/v1/proposalsproposals:read

The detections Talon suggests a workspace builds next: library content that matches its data streams, open coverage gaps, and Forge blueprints not yet saved as detections. Read-only: promoting a proposal to a change request stays in the app.

Query parameters

workspaceIdstring (UUID)

Required with an org-scoped token; a workspace-bound token uses its own workspace.

Response

idstring

content-match:<stream>:<rule>, coverage-gap:<gap> or forge-blueprint:<blueprint>.

kindstring

content_match | coverage_gap | forge_blueprint

statusstring

ready_for_change_request | needs_content_match | needs_forge_preview

prioritystring

high | medium | low

titlestring

summarystring

recommendedActionstring

mitreTechniqueIdstring · nullable

mitreTechniqueNamestring · nullable

sourceobject

type (security_content | coverage_gap | forge_blueprint), id, name, and for a content match confidence, matchScore (up to 100) and matchReasons[].

streamobject · nullable

id, name, schemaType, sourceStatus, sourcetype — the data stream it would run on. Null for a coverage gap.

draftDetectionobject · nullable

The detection it would stage: name, description, mitreTactic, mitreTechniqueId, confidence, falsePositiveNotes, sigma, securityContentId, status (draft) and queries { splunk, sentinel, elastic, chronicle }. Null for a coverage gap, and for a Forge blueprint that has no preview yet.

targetReadinessobject

defaultTarget (the workspace's primary SIEM), availableTargets[] and missingTargets[] (the SIEMs the draft has or lacks a query for), hasDefaultTargetQuery.

workspaceIdstring (UUID)

createdAtstring (ISO 8601)

updatedAtstring (ISO 8601)

Returned as { data: [...] }, at most 50: high priority first, then by match score, then most recently updated. Library content already saved on that stream, or matching a technique a detection on it covers, isn't proposed.

Request

curl -H "Authorization: Bearer tlk_…" \
  "https://<your-instance>/api/v1/proposals?workspaceId=…"

Response

{
  "data": [
    {
      "id": "content-match:6a9c…:b84e…",
      "kind": "content_match",
      "status": "ready_for_change_request",
      "priority": "high",
      "title": "Windows PowerShell Download and Execute",
      "summary": "…",
      "recommendedAction": "Promote this matched content into a change request, review the generated detection, validate it, and merge after approval.",
      "mitreTechniqueId": "T1059.001",
      "mitreTechniqueName": "PowerShell",
      "source": {
        "type": "security_content",
        "id": "b84e…",
        "name": "Windows PowerShell Download and Execute",
        "confidence": "high",
        "matchScore": 96,
        "matchReasons": ["required_sourcetype:wineventlog", "mitre_technique:T1059.001"]
      },
      "stream": {
        "id": "6a9c…",
        "name": "Windows Security",
        "schemaType": "CIM",
        "sourceStatus": "active",
        "sourcetype": "wineventlog"
      },
      "draftDetection": {
        "name": "Windows PowerShell Download and Execute",
        "status": "draft",
        "queries": { "splunk": "…", "sentinel": null, "elastic": null, "chronicle": null }
      },
      "targetReadiness": {
        "defaultTarget": "splunk",
        "availableTargets": ["splunk"],
        "missingTargets": ["sentinel", "elastic", "chronicle"],
        "hasDefaultTargetQuery": true
      },
      "workspaceId": "d41f…",
      "createdAt": "2026-10-20T08:00:00.000Z",
      "updatedAt": "2026-10-20T08:00:00.000Z"
    }
  ]
}