Brain
The workspace as a security organisation, and the knowledge graph the agents reason over (connected SIEMs, telemetry, ATT&CK coverage, detections and skills), with local embeddings by default and your own model as an option.
The Brain
Talon Claw → Brain (/claw/knowledge) shows the workspace as a security organisation, in Graph, Chain and Neural views: seven departments, each listing the work it owes and the agents, tools and playbooks under it, with every piece of work marked running, idle, can't reach, unowned, or kept with a person. Playing an agent run lights what it touched, step by step.
The same canvas carries the connected model the agents reason over: your connected SIEMs, the telemetry they carry, the ATT&CK techniques that telemetry makes detectable, your detections, and the skills that teach those techniques. It lets an agent see how a gap, a technique and a detection relate rather than treating each in isolation.
Retrieval blends vector similarity, keyword matching and a graph traversal of up to 2 hops, so a query that matches a skill can also surface a detection two hops away (skill → technique → detection) that no keyword or vector match alone would return. An intent classifier decides when the graph hop is worth its cost: relational, causal and exploratory questions pay for it (graph weight of 0.5 or more), while factual and temporal lookups skip it.
Embeddings
Semantic search across the graph needs an embedding model, and one ships with Talon: BGE small (Xenova/bge-small-en-v1.5, ONNX, 384 dimensions, 34 MB), run inside the app process. A second small model, the reranker (87 MB), reads the best matches against the question and reorders them. Both download from Hugging Face on first use, and again whenever the container is recreated — every upgrade does that, and on Kubernetes so does every pod restart — so the appliance needs outbound access to Hugging Face at those moments. A search never waits for the reranker: until it has loaded, or if it cannot, results keep the order the other passes agreed on. Set TALON_RERANK=off in .env to turn it off.
After upgrading on the built-in model from an image published before 5 October 2026, choose Rebuild index under Talon Claw → Settings once (the page may say Embedding model changed — rebuild recommended). Until then, what was indexed before the upgrade is found by its words only.
To use your own model instead, an admin adds a connection with purpose Embeddings (semantic search) under Talon Claw → Settings, pointing at any OpenAI-compatible /v1/embeddings endpoint: OpenAI (for example text-embedding-3-large) or a self-hosted model such as Ollama's nomic-embed-text. It takes precedence over the local model; click Rebuild index on the same page after switching. Anthropic and xAI offer no embeddings API, so they cannot be used for this. Either way embeddings are decoupled from chat: chat works without them, and they only enrich retrieval over the graph.