Talon FlowTalon Studio v1.0.2-beta

Templates

Start an automation from a built-in or shared template instead of a blank canvas, and import or export flows as YAML to share and version them.

Starting from a template

Talon Flow → Templates (/flow/templates) lists starter automations. Selecting one shows its steps; Open in builder loads the trigger, nodes and edges onto a new canvas for you to tune and save. A template is only a starting point: nothing runs until you save the flow and its change request merges.

Seven templates are built in, in two groups:

New CVE response

Detection engineering. Trigger: New KEV CVE.

Daily coverage sweep

Detection engineering. Trigger: Schedule, every day.

Webhook → search → alert

Detection engineering. Trigger: Webhook.

Validation failure alert

Detection engineering. Trigger: Validation failed.

Scheduled threat sweep

SOC operations. Trigger: Schedule, every 6 hours.

Webhook alert enrichment

SOC operations. Trigger: Webhook.

Alert landed → notify

SOC operations. Trigger: SOC alert landed.

Below them the page lists Organisation templates and Workspace templates: flows your team saved as reusable starting points. When a workspace template and an organisation template share a name, the workspace one is shown.

Import, export & scope

Save as template. In the builder, Save as a reusable template asks where it lives. Workspace commits it straight to the workspace repository at agents/skill-templates/<slug>.yaml, available at once (a template is not runnable, so it needs no change request). Organisation stages it in the organisation's configuration; an admin commits it under Settings → Organisation, and it then shows in every workspace. Saving a template needs the engineer role.

Export. Export as YAML downloads the flow as <slug>.yaml, the same format Git stores.

Import. Import on the Automations page takes pasted text or a .yaml, .yml or .json file, validates it against the automation schema, and loads it onto the canvas. A malformed or hand-edited file is rejected with the schema errors; nothing is saved until you click Save.

Scope. Flows and templates are either workspace-scoped, living in the workspace repository, or organisation-scoped, shared across every workspace. Organisation flows run manually or as a step in a workspace flow; only workspace flows fire their triggers automatically.

Tip

After importing or opening a template, run Test run before saving: node parameters such as searches, notification targets and agent names are environment-specific. A webhook token never travels in the YAML, so an imported webhook flow gets its own new URL once it is saved and merged.