A MITRE ATT&CK coverage matrix built from real SIEM evidence — see what you can detect, what you do detect, and the gaps that are one detection away.
What it is
Talon Atlas answers "where am I covered?" honestly. Instead of a wishful heatmap, Atlas maps your actual telemetry to MITRE ATT&CK and separates what your data can support from what you have deployed — so coverage reflects reality, not aspiration.
How it works
Atlas combines your detection inventory, the rules already enabled in your SIEM, the content library and the evidence Talon Connect synced. Each technique cell takes one state:
Covered
A saved Talon detection in this workspace, or an enabled rule imported from the SIEM, maps to the technique. Coverage on a sub-technique paints its parent too.
Recommended
No detection covers it yet, but a content-library rule for it matches data you actually have — deployable now. These amber cells are your best next detections.
In library
Library content exists for the technique, but the data it needs isn't in your SIEM yet (shown as needs data).
No data
Nothing covers the technique and no library rule matches it.
The result is a tactics × techniques matrix — green for covered, amber for recommended, violet for in library, grey otherwise. Clicking a cell opens the technique panel with its detections (marked Saved, Deployed or Live) and the candidate library rules that match your evidence; each rule links into Forge's Library pre-selected. The coverage totals feed the Command dashboard.
What counts as evidence
A CIM data model only counts as evidence if it's actually populated — mapped sourcetypes or non-zero field-fill — not merely defined; Splunk's own empty stock CIM models don't count. A sourcetype with zero events is catalogued but empty and is excluded from detectability even though it exists in the index. Recommended specifically requires a library rule's sourcetypes and its required CIM model to both actually carry data — referencing a data model isn't a real recommendation on raw logs alone. And Talon's own simulation index (talon_range) is excluded from detectability entirely, so running Threat Simulation never inflates your coverage numbers.
Setup
1
Connect a SIEM first — Atlas is derived from Connect's evidence, so it needs a field catalogue to reason over.
2
Open /atlas; the heatmap builds from your sourcetypes, deployed detections and the content library.
Usage
Read the matrix: Covered cells already have a detection or an enabled SIEM rule; Recommended cells are deployable now from your evidence — your best next detections; In library means content exists but the telemetry it needs isn't there yet.
Narrow the view with the filters — Recommended, Covered, In library, Have data and No coverage — or pick an ATT&CK group or campaign to overlay only the techniques it uses.
Click a cell to see the sourcetype that carries the needed fields and the candidate library rules.
Open a matching library rule from the technique panel — it lands in Forge → Library ready to import — or use Forge Builder's Start from a coverage gap launcher to seed a new detection with the technique and log source; once deployed, the cell turns covered on the next refresh.
Talon Atlas → Coverage
The coverage matrix with a technique panel open. Use the Recommended filter to isolate the amber deployable-now cells, click one, and open a matching library rule — it links straight into Forge's Library with the rule pre-selected.
Tip
Work gaps on your highest-volume sourcetypes first — a technique backed by data you already ingest heavily is the one most likely to actually fire in production, and it closes the cell with zero new onboarding.