Talon ClawTalon Studio v1.0.2-beta

Agents

Ten propose-only agents, plus any custom agents an admin adds. Enable, tune and route work to them within strict bounds.

The agents

Talon Claw → Agents (/claw/agents) lists eleven built-in agents, all propose-only: none can approve, merge or deploy. A general-purpose assistant sits alongside ten specialists, each with its own role instruction and tool allow-list.

Talon Assistant

General detection-engineering copilot with the full read and propose toolset. The default in chat.

Detection Engineer

Builds and refines SIEM detections from threat intel, mapped to ATT&CK and a real log source.

Coverage Analyst

Analyses ATT&CK coverage and telemetry gaps, and proposes detections to close the highest-value gaps.

Data Engineer

Diagnoses SIEM data and CIM gaps (missing data models, unmapped sourcetypes, onboarding issues) and writes the fix for your SIEM.

Threat Hunter

Develops hunting hypotheses from threat intel and telemetry, then turns confirmed leads into proposed detections.

Cyber Intel Analyst

Turns threat intelligence into a picture of the org's adversary exposure and the highest-leverage gaps to close.

Threat Modeler

Builds and reviews STRIDE threat models of your systems, maps each threat to ATT&CK, and says which log sources and detections are missing.

Triage Analyst

Investigates failing validations and replays, finds the root cause, and proposes a fix.

SOC Analyst

Triages SOC alerts: gathers entity context from the SIEM, assesses true or false positive, and recommends a disposition. Proposes a suppression edit for false positives; never closes the case.

Reviewer

Reviews change requests, human- or agent-authored, against the diff, the target sourcetype and detection quality, then posts findings and a verdict to the discussion. Advisory unless the review policy makes it blocking.

Operations

Helps admins onboard users and set up SIEM connections by proposing the change for the admin to approve. Never handles credentials.

Tuning & autonomy

The Agents page has three tabs: Agents (the roster), Actions (SIEM changes agents have proposed, which a person applies in the SIEM) and Activity (runs). Changing agents is admin-only:

Enable or disable each agent with its switch. A disabled agent drops out of the chat picker and Claw stops routing work to it.

Configure opens the editor: Prompt, Tools (the allow-list), Knowledge (which vendored skill playbooks it may use; none by default), Automations (saved flows it may run), and Model (a model other than the org default, plus its voice), and Versions (the agent's history, below). Reset to default restores a built-in agent.

New agent creates a custom agent with the same controls; custom agents can be deleted.

With the Claw coordinator on, the scan routes incoming signals to the right specialist: a coverage_gap to the Coverage Analyst, or to the Data Engineer when the fix is onboarding a missing sourcetype or CIM model rather than writing a rule, or straight to the Detection Engineer when the gap's fix is build_detection; a low_precision detection to the Detection Engineer for tuning; validation_failure to the Triage Analyst; and pipeline_failure, kev and kev_coverage_gap to the Detection Engineer. Rule-health findings from Monitor (broken_reference, never_fires) and ti_report gaps also go to the Detection Engineer. Whether a routed proposal waits for approval or dispatches at once is the workspace's Claw autonomy: Off, Propose (default) or Auto-dispatch.

Bounded by design

Agent work is capped by AGENT_MAX_CONCURRENT (default 3 per org), AGENT_MAX_RUNS_PER_DAY (default 0, unlimited), AGENT_MAX_HANDOFF_DEPTH (default 4 agent-to-agent handoffs in one chain), and the org's token and cost budgets. The AGENT_RUNS_DISABLED kill switch stops all new agent runs at once.

Versions

Every agent keeps a version history. A version is a full copy of what the agent runs with: its prompt, tools, skill domains, skills, automations and model. A new one is made when an admin saves the agent, and when a Studio update changes a built-in agent; a built-in agent that was already edited when versioning began gets the built-in as v1, so the first edit has something to compare with. Every run is stamped with the version it ran under, and only one version of an agent is active at a time.

The Versions tab in the agent editor lists versions newest first: Active or Retired, where each came from (Built-in, Edited or Rollback), its runs, the share that succeeded, and the thumbs up and down people gave those runs. Open one to see which fields changed since the version before, and the prompt lines removed and added.

Restore this prompt (admins) brings back an earlier version's prompt as a new version, used from the next run. Only the prompt comes back: tools, skills and model stay as they are now. Restoring a built-in agent's own prompt clears the edit, so the agent keeps following Studio's updates to it.

Improving an agent

The top of the Versions tab lists what the agent's last 14 days keep showing. Each finding is counted from its runs, never guessed:

The same failure

The same error, with ids and values set aside, in three or more runs.

A tool erroring

Calls to one tool failing in two or more runs. Often configuration rather than the agent.

Reviewed runs

A critic tag such as missing evidence or incomplete in three or more reviewed runs, or the last ten reviewed runs averaging under 60.

Thumbs-down

Two or more runs given a thumbs-down, with the reasons people wrote.

Review recent runs (admins) has your AI provider grade up to five unreviewed runs from the last 14 days on accuracy, quality and completeness, 0 to 100 each, failed and thumbs-down runs first. A version shows its score once ten of its runs are reviewed. Every finished run also gets a mechanical record of whether it succeeded and how much went wrong.

Propose an improvement (admins) drafts a new prompt that answers the findings. It changes only the prompt: the agent's tools, skills and model are copied from the live agent, so a proposal cannot widen them. A prompt that is empty, unchanged, over 8,000 characters or more than about a sixth longer is thrown away. If the findings point at a tool or configuration rather than the prompt, the proposal says so and nothing is drafted.

Activate puts a draft into service from the next run, keeping any change to tools, skills or model made since it was drafted. Discard turns it down. One draft waits at a time.

Only when someone asks

Nothing reviews or proposes on a schedule. Both buttons call your AI provider, count toward the token and cost budgets, are refused with 429 once a budget is reached, and show on Talon Claw → Usage as Run reviews and Agent improvement proposals.