Connect your SIEMs and introspect them — indexes, sourcetypes, fields and CIM compliance — to build an Evidence Grid of what you can actually detect.
What it is
Talon Connect is the front door to your telemetry. It connects to the SIEMs you already run — Splunk first, with Microsoft Sentinel, Elastic Security and Google Chronicle (SecOps) — reads what data and detections they already hold, and turns that into an Evidence Grid: the ground truth for what your environment can and cannot detect. It reads metadata only — stores, datasets, fields, data models and rules — and never copies raw events out of your SIEM.
Everything downstream — Atlas coverage, Forge authoring, Monitor validation — is anchored to this evidence, so you never build detections your data can't fire.
How it works
Every backend implements one vendor-neutral BackendConnector contract, so the platform stays SIEM-agnostic:
readSchema()
Reads indexes, sourcetypes, fields and CIM data models into a field catalogue — the evidence of what telemetry exists.
listExistingDetections()
Imports the SIEM's existing saved searches / analytics rules and maps them to ATT&CK, so prior coverage counts.
backtest(query, window)
Optional. Runs a bounded historical search on the live SIEM and returns a hit count — used by a detection's Backtest panel and the change-request alert-volume estimate.
Adding a connection persists a ConnectedBackend record. The token is encrypted at rest with TALON_ENCRYPTION_KEY and never returned by the API; the connection's non-secret settings are versioned as YAML — under Talon/integrations/siem/ in the workspace repo for a workspace-scoped connection, or Org/integrations/siem/ in the org config repo for an organisation-wide one. A sync then reads the schema and imports existing rules; Atlas derives detectability from that catalogue. Upstream pipelines (Cribl, Vector, Logstash), XDR endpoint sources (CrowdStrike, Defender), VirusTotal and ServiceNow connect separately under Integrations.
Backtest covers Splunk and Sentinel only
backtest() is optional in the connector contract. Chronicle doesn't implement it (its search API isn't wired in), and Elastic is held back on purpose: its connector searches with Lucene while deployed Elastic rules are EQL, so a backtest would return wrong counts rather than an error. Backtesting, and the "would have fired N times last week" estimate on a change request, therefore run against Splunk and Sentinel connections only.
Setup
1
Open Talon Connect → SIEM (/connect/siem), click Connect SIEM and pick Splunk, Microsoft Sentinel, Elastic or Chronicle (and On-Prem or Cloud for Splunk).
2
Choose what the connection is for — Read data (import schema and existing detections), Deploy detections (push validated rules back) and, on Splunk, Test target (run Threat Simulations over HEC).
3
Enter the endpoint and auth token; the fields differ per SIEM — see SIEM Connections. For a SIEM behind a private CA, open Advanced TLS to paste the CA certificate or allow a self-signed one.
4
Click Connect. Talon syncs straight away — stores, datasets and fields (plus data models, macros and lookups on Splunk) and existing detections — and keeps the catalogue fresh on its own: a full sync every hour and a lighter index-and-volume poll every five minutes.
Sentinel & Elastic need more than the query endpoint
Sentinel's endpoint is the Log Analytics workspace query URL; importing analytics rules also needs the Azure workspace identity (subscription ID, resource group and workspace name), from which Talon derives the ARM alertRules URL. Elastic's endpoint is the Elasticsearch base; importing detection rules also needs a Kibana base URL (plus an optional space), which the connect dialog does not ask for — see SIEM Connections.
Community Edition
The Community Edition connects one SIEM and one deployment target — hard caps per organisation, not per workspace. Once the SIEM is connected the card reads SIEM limit reached, and another attempt is refused with "SIEM connection limit reached (1/1). More come with Enterprise, which is in development." Removing a connection frees the slot. Federated search across several SIEMs is an Enterprise feature.
Usage
Review discovered sourcetypes and their field coverage — this is your Evidence Grid. The Connect overview (/connect) shows the status of every SIEM, detection source and integration in one list.
Adopt existing SIEM detections in Forge at /forge/adopt (all four SIEMs) to bring native rules under Git-backed management, or sync an external detection repo at /connect/detection-sources.
Wire upstream pipelines and XDR sources at /connect/integrations, and manage threat feeds under Talon Threat → Threat Feeds (/threat-intel/feeds).
After fixing a wrong endpoint or rotating a token, save it in the connection's settings — changing either re-runs the sync immediately instead of waiting for the hourly one. Recheck connection on the card re-runs the connectivity probe on demand.