The mission-control dashboard for the selected workspace — ATT&CK coverage, detection maturity, evidence gaps, validation and replay health, and Claw activity, in one place.
What it is
Command → Overview (/command/overview, headed Mission Control) is the default landing surface. It reads the selected workspace's detection inventory, ATT&CK mappings, synced SIEM evidence and validation runs, and turns them into coverage, gap and health signals, so you can see the state of your detection programme at a glance rather than assembling it by hand.
Command aggregates the evidence the rest of Talon produces and renders it as one page, scoped to the workspace in the switcher.
Live feed — a ticker across the top: a SIEM connection going down or its evidence syncing, recent validation runs, new evidence gaps, KEV CVEs Talon has ingested since it was installed, and dismissible nudges for the next pipeline or Git step.
Detection Maturity — a 0–100 score with the factors behind it and a weekly trend (it reads Baseline until there is enough history), plus Total, Active, Draft and Failing detection counts.
Evidence gap backlog — evidence gaps opened against gaps resolved, over 7 or 30 days.
Product chips — Talon Atlas (ATT&CK coverage percentage, covered of detectable, open gaps), Talon Forge (drafts against deployed), Talon Replay (share of detections passing simulation) and Talon Monitor (readiness score: detections that can run in the connected SIEM).
Coverage heatmap — tactics × techniques. A technique is covered when a Talon detection or an enabled rule already in your SIEM maps to it, available (amber) when your telemetry makes it detectable but nothing covers it, library when only content-library rules exist for it, and empty otherwise.
Evidence panel — four tabs beside the heatmap: Evidence Gaps, Threat Readiness, Validation Runs and Replay Runs. Evidence Gaps is fed by 13 distinct gap kinds (a sourcetype with live data but no running detection, a detection with no live target, a managed detection that has drifted or was never validated, and others), each carrying a severity (critical/high/medium/low/info) and a confidence (confirmed/probable/inferred).
Talon Claw and My work — Claw's Proposed, Succeeded, Failed and Review counts (with a link to switch Claw on when it is off), and your own change requests, tickets, overdue and due-soon cards.
Vantage (/command/vantage) — a WebGL topology that maps your SIEM's stores and datasets to techniques and detections, so you can see the evidence-to-coverage graph.
Setup
Command needs data to reflect — it becomes meaningful once a workspace has evidence and detections.
1
Connect a SIEM in Talon Connect so Command has evidence to map coverage against.
2
Author and deploy a few detections in Forge — they populate the heatmap and health metrics.
3
Open /command/overview; use the workspace switcher to change which workspace the dashboard reflects. The Community Edition has one workspace, so there is nothing to switch between.
Usage
Scan the heatmap for amber (detectable but uncovered) techniques, then open the Evidence Gaps tab to see what is missing and why.
Watch the Talon Monitor chip and the Failing count under Detection Maturity — a falling readiness score means detections can no longer run against the data in your SIEM.
Open /command/vantage to trace a technique back to the exact sources that feed it.
The heatmap's Full map link jumps straight to /atlas for the full coverage matrix.
Tip
The heatmap only reflects the workspace shown in the switcher — if coverage looks unexpectedly thin, confirm you're on the right workspace before treating an empty cell as a real gap.