CommandTalon Studio v1.0.2-beta

Vantage

A WebGL topology that traces your coverage from SIEM indexes and sourcetypes through ATT&CK techniques to deployed detections.

The topology

/command/vantage renders the data Talon reads from your SIEM as a live graph: the SIEM, its stores and datasets (indexes and sourcetypes on Splunk), the detections that query them, and the upstream pipelines feeding it. It's the evidence-to-coverage picture — pick a technique in the catalogue rail to trace it back to the exact sourcetypes that feed it and forward to the rules that watch it.

indexsourcetypedetectionsilent source

Catalogue rail — the left rail catalogues everything the sync captured: your SIEM's stores and datasets (labelled in its own vocabulary — indexes and sourcetypes on Splunk), Techniques, Unmapped models, Detections, Eventtypes, Lookups, Macros, Tags, Apps and Gaps, each with a count and — where it applies — live/idle or enabled/disabled sub-tabs.

Upstream pipelines. When Cribl is connected under Integrations, Vantage also traces its pipelines — health, whether a pipeline ships to the SIEM, its destination index, and dropped-event ratio — extending the topology past the SIEM itself. Vector and Logstash appear too; they link to your SIEM data once you give each integration its sink-to-index or output-to-index mapping.

The graph is powered by GET /api/workspaces/<id>/evidence-topology, so it shows what the last SIEM sync captured for the selected workspace.

Filtering

Focus the graph with the bottom toolbar: search across sources, stores, datasets and detections; under Sources, toggle Apps (shown only when the SIEM has apps, a Splunk concept) and All indexes (the word follows your SIEM's vocabulary); and switch the Rules view between enabled (the default), all and disabled. The catalogue rail marks enabled versus disabled rules and live versus idle sources, and its Gaps section lists evidence gaps by severity, with filters for blind spots, CIM, no target, missing fields, dependencies and managed detections.

Right-click a node for Open details, Ask Talon Claw, Focus on this and, where a node has detections behind it, Show detections / Hide detections. Save screenshot, beside the zoom controls, downloads the whole topology as a PNG.

Tip

Filter the Gaps section to Blind spots — sourcetypes with live data but no enabled, scheduled detection. Those are sources you're ingesting (and paying to store) but not yet detecting on, usually the cheapest coverage wins.