Skip to content
DocumentationAPI ReferenceChangelog
API ReferenceTalon Studio v1.0.6-beta

Replay

Read a workspace's Replay threat scenarios — multi-stage attack chains — and how each one's latest run went.

List scenarios

GET/api/v1/scenariosscenarios:read

A workspace's Replay threat scenarios, most recently updated first, each with the verdict of its latest run. Running a scenario stays in the app.

Query parameters
workspaceIdstring (UUID)
Required with an org-scoped token; a workspace-bound token uses its own workspace.
Response
idstring (UUID)
namestring
descriptionstring · nullable
kindstring
draft | active — active scenarios count in coverage scoring and are compiled into the deployed Splunk package.
stagesarray
The chain, in order: stageOrder, detectionId, techniqueId (nullable), label (nullable).
correlationWindowstring
The window every stage must fall within, e.g. 24h.
riskThresholdinteger
The minimum aggregate risk score across the chain before a notable fires.
lastRunVerdictstring · nullable
detected | broken | no_telemetry | error — the latest run's verdict on the whole chain; null when it has never run or the run has no verdict yet.
regressedboolean
The latest run didn't detect the chain, but an earlier run did.
updatedAtstring (ISO 8601)
Returned as { data: [...] }. Deleted scenarios are left out.
Request
curl -H "Authorization: Bearer tlk_…" \
  "https://<your-instance>/api/v1/scenarios?workspaceId=…"
Response
{
  "data": [
    {
      "id": "5f2d…",
      "name": "Phish to ransomware",
      "description": null,
      "kind": "active",
      "stages": [
        { "stageOrder": 1, "detectionId": "7c2a…", "techniqueId": "T1566.001", "label": "Initial access" },
        { "stageOrder": 2, "detectionId": "9d4f…", "techniqueId": "T1486", "label": "Impact" }
      ],
      "correlationWindow": "24h",
      "riskThreshold": 60,
      "lastRunVerdict": "broken",
      "regressed": true,
      "updatedAt": "2026-10-24T16:05:00.000Z"
    }
  ]
}