Talon ClawTalon Studio v1.0.2-beta

Proposals

The review queue of work Claw has proposed. Each proposal is approved (dispatching the routed agent) or dismissed, and nothing is applied without a human.

The proposal queue

Talon Claw → Proposals (/claw/proposals) holds everything Claw has queued across your workspaces, filterable by signal. Each proposal names its workspace (or "Org-wide"), the agent it routes to, and the evidence behind it, so you review the reasoning before acting. The Claw scan raises most of them, which needs the Claw coordinator switched on in Talon Claw → Settings; a workspace whose Claw autonomy is Off raises none.

KEV gap

kev_coverage_gap: a KEV CVE that is deployable in your environment has no covering detection.

Coverage gap

coverage_gap: an ATT&CK or telemetry coverage gap.

New KEV

kev: a newly published CISA KEV entry.

Validation failed

validation_failure: a detection failed validation.

Deploy failed

pipeline_failure: a detection deploy to a SIEM failed.

Low precision (noisy)

low_precision: a detection with a high false-positive rate across recent SOC dispositions and feedback, with the dominant false-positive field/value clusters attached as exclusion evidence.

Broken rule

broken_reference: an installed SIEM rule leans on a missing macro, lookup or dead sourcetype, so it can never fire as written (from the Rule Health engine).

Silent rule

never_fires: a scheduled rule with zero successful dispatches in 30 days, from the SIEM's own scheduler history.

TI report

ti_report: an analysed threat-intel report describes ATT&CK techniques no enabled rule covers (see Talon Threat → Analyze report).

Recurrence folds, it doesn't stack

A repeat of the same signal (validation failing again, another noisy week) does not open a second proposal. Talon appends a "↻ ..." note to the existing pending one, keyed by the signal's stable reference, so the queue stays one row per underlying issue.

Standing conditions re-open only on a real regression

Rule-health findings (Broken rule, Silent rule) describe a condition that stays true, so once you resolve or dismiss one it does not nag every scan. It re-opens only when the snapshot history shows a new episode: the rule recovered and then broke again after your decision.

Approve or dismiss

Open a proposal and read the evidence behind it.

Approve & assign dispatches the routed agent and makes you the assignee who follows its work through. The agent's change requests are opened for review automatically, validated, and reviewed by the Reviewer agent when the review policy says so. Approving needs an AI provider configured and a role above read-only.

Dismiss removes a proposal from the queue. Dismissing a Coverage gap also marks the gap won't-fix, with an optional reason, and Claw will not raise it again.

screenshot — The proposal queue. Open a proposal to read the evidence behind it, then **Approve & assign** to dispatch the routed agent, or **Dismiss** to clear it from the queue.

Tip

Approving a proposal never applies anything directly. The agent's drafts land as change requests that go through the same validation gate and review policy as any human edit before they can reach main. A workspace set to Auto-dispatch skips this approval step, but not the change-request review.