Talon ConnectTalon Studio v1.0.2-beta

Detection Sources

Sync detection content from external Git repositories your team — or the community — already maintains.

External detection repos

At Talon Connect → Detection Sources (/connect/detection-sources), point Talon at an external detection repository — on GitHub, GitLab, Gitea or Azure DevOps, or any public repo — to import its rules into your workspace. It's the way to build on rules a team or the community already maintains, versioned in Git like everything else.

Source name

A label for the source, e.g. SigmaHQ Community Rules.

Repository URL · Branch

The repo to clone and the branch to read (e.g. https://github.com/SigmaHQ/sigma.git, main).

Access token

For every provider except Public. Encrypted at rest and never returned by the API; leave it blank on edit to keep the stored one.

Detection format

Sigma, Talon YAML (Talon's own detection-as-code), Splunk YAML (Security Content), Sentinel YAML, Elastic TOML (elastic/detection-rules) or Chronicle YARA-L.

Path filter

Optional subdirectory to scan, e.g. rules/windows. Blank scans the whole repo.

Auto-sync

When on, the source is re-synced in the background — hourly by default (DETECTION_SOURCE_SYNC_INTERVAL_MS).

Imported rules stay in the source until you Fork one into the workspace, choosing the sourcetype it runs on; the fork becomes an ordinary draft detection. Removing a source deletes its imported rules but keeps anything you have already forked.

SIEM & XDR sources

Adopting rules that already live in a connected tool happens elsewhere, not here:

SIEM saved searches. Adopt existing Splunk, Sentinel, Elastic or Chronicle rules in Forge at /forge/adopt — it works across all four backends, converting each into a Talon detection under Git-backed management.

XDR endpoint rules. CrowdStrike and Defender connect as XDR integrations at /connect/integrations; their endpoint detections flow into Talon SOC.

Adopted rules are native, not Sigma

A rule adopted via /forge/adopt lands as a native detection — its original query copied verbatim, with no Sigma conversion. Adoption is idempotent (re-running it skips anything already adopted), and Talon's own Splunk deploys — saved searches named "Talon - <technique> - <name>" — are recognised and never offered as adopt candidates. On Sentinel, Elastic and Chronicle, Talon's deployed rules carry the plain detection name, so they are not filtered out — leave them unticked.

Tip

When you adopt a rule from a SIEM, run the Talon copy through Monitor and confirm it fires before you disable the original — adoption never turns the native rule off for you, so you never open a coverage gap during the hand-over.