Talon ConnectTalon Studio v1.0.2-beta

Integrations

Connect the pipeline, endpoint, enrichment and ITSM tools around your SIEM, and route Talon's notifications to Slack or Microsoft Teams.

Pipelines, XDR & enrichment

At Talon Connect → Integrations (/connect/integrations), connect the systems around your SIEM. Each integration is scoped to one workspace or to the organisation, like a SIEM connection, and its secret is kept encrypted — on edit, leave it blank to keep the stored one.

Cribl

Cribl.Cloud (API base URL such as https://main-<org>.cribl.cloud/api/v1, client ID and client secret) or an On-prem leader (for example https://leader:9000/api/v1, with a username and password or a static auth token). Each sync captures per-pipeline health, disabled inputs, and the worker and edge nodes the leader manages. A connected Cribl Lake can then be enabled as a search source in Talon Search → Data Lakes (in beta).

Vector

The GraphQL API URL (for example http://vector.internal:8686/graphql), an optional bearer token, and a sink to index mapping — one sink = index per line — so Vantage can tie each sink to your SIEM data.

Logstash

The monitoring API URL (for example http://logstash.internal:9600), an optional username and password, and an output to index mapping. Without the mapping Logstash still appears in Vantage but doesn't link to your SIEM data.

XDR endpoint

CrowdStrike Falcon (API base URL, client ID, client secret) or Microsoft Defender (Microsoft Graph URL, client ID, directory (tenant) ID, client secret), each with its own credentials. Their endpoint detections flow into Talon SOC as alerts.

Threat intel

VirusTotal: API base URL and API key. Its Allow agents to query switch lets Talon agents look up a live reputation verdict for an IP, domain, hash or URL during a triage run; it is off by default and every lookup is audited.

ServiceNow

Instance URL, username and password, for CMDB enrichment. Pulling recent ServiceNow incidents into the SOC alert queue is a separate switch, off by default.

Tip

Connect Cribl before chasing silent-source gaps — from the SIEM side, a pipeline dropping events upstream looks identical to a broken forwarder. With Cribl connected, Vantage draws each pipeline with its health and dropped-event ratio, so you can tell the two apart at a glance.

Notifications

Notification destinations live under Admin → Integrations (/settings/integrations), which only admins can open. Add a Slack or Microsoft Teams destination, set its minimum severity (Info+, Success+, Warning+ or Critical) and the workspaces it covers, and choose which events it receives: pipeline, validation and deploy failures, coverage gaps and drift, release blocked, content sync, branch pushes, Workboard moves, threat intel, SIEM connection health, change request assigned, SOC cases and system notices. Send test message checks a destination before you rely on it.

PagerDuty paging and Jira ticketing for SOC cases are configured in Talon SOC → Settings (/soc/settings), not here.