Talon FlowTalon Studio v1.0.2-beta
Triggers
How a flow starts: on demand, on a schedule, from an inbound webhook, or in reaction to a platform event, and what each trigger puts on the blackboard.
Trigger types
Every flow has exactly one trigger. The builder shows the label in the first column; the YAML stores the value under it. Each trigger's context is available downstream as ${trigger.<field>}.
| Trigger | Fires when | Fields on the trigger |
|---|---|---|
| Manual manual | You click Run in the Automations list, or another flow runs it as a subflow or loop step. | — |
| Schedule schedule | Its interval has elapsed: every 15 minutes, hour, 6 hours, day or week. | firedAt |
| Webhook webhook | A system sends POST /api/flow/hook/<token>. | body, firedAt |
| Change request merged change_request_merged | A change request merges to main in the workspace. | changeRequestId, title |
| Validation failed validation_failure | A detection fails validation. | detectionId, detectionName, failureReason |
| Deploy failed pipeline_failure | A detection deploy to a SIEM fails. | detectionId, detectionName, siemType, error |
| SOC alert landed soc_alert | A new, unsuppressed alert lands in Talon SOC for the workspace. | candidateId, title, severity, techniqueId, detectionId, source |
| New KEV CVE kev | The Claw scan raises a proposal for a genuinely new CISA KEV CVE. | cveId, title, reason |
| New coverage gap coverage_gap | The Claw scan raises a coverage-gap proposal, including a KEV coverage gap. | gapId, cveId (KEV gaps), title, reason |
| Kanban card kanban | A card is created on the workspace board. | cardId, title |
When triggers fire
Only active, workspace-scoped flows fire on their own. Schedule, webhook and platform-event lookups select flows bound to a workspace with the Active toggle on. An organisation-scoped flow runs manually, or as a subflow or loop step inside a workspace flow; org-flow auto-triggering is deliberately deferred.
Schedules tick with the Claw scan. A schedule is not its own cron. It is checked on the org's Claw scan, every CLAW_INTERVAL_MS (15 minutes by default), and fires when its interval has elapsed since the flow last ran. The scan only runs for orgs with the Claw coordinator switched on (Talon Claw → Settings → Behaviour, off by default) and an AI provider configured.
New KEV CVE and New coverage gap follow Claw proposals. They fire when the Claw scan creates a new proposal for the workspace, so they need the Claw coordinator on and the workspace's Claw autonomy set to anything but Off.
SOC alert landed needs Talon SOC. Alerts are pulled from your SIEM only for workspaces that feed Talon SOC, and routing a workspace into the SOC console is an Enterprise feature (in development).
Every firing is a governed run. A triggered run is a system run that goes through the same check as a manual Claw run, so it is still bounded by AGENT_MAX_CONCURRENT, AGENT_MAX_RUNS_PER_DAY, the token and cost budgets, and the AGENT_RUNS_DISABLED kill switch.
An event flow without an AI provider
If an event fires a flow that contains an AI step (draft_detection, llm_call, run_agent, subflow or loop) and no AI provider is configured, Talon records a failed run saying so rather than silently skipping it. Flows with no AI step fire without a provider.
Webhooks
A webhook flow is started by an HTTP POST to its own URL. Any system that can send one (a SIEM alert action, a CI job, another tool) can start the flow; a JSON body is available downstream under ${trigger.body.<field>} (for example ${trigger.body.cve} in the request below), alongside ${trigger.firedAt}. The body may be up to 16 KB; a body that is not JSON is ignored and the flow still runs.
Webhooks need an AI provider
An inbound hook starts an agent run, so the endpoint returns 503 until an AI provider is configured under Talon Claw → Settings. Set one up before pointing external systems at the hook URL.
Tip
The token is the only credential: anyone holding the URL can start the flow. Each webhook flow has its own token, stored only in the database and never in the flow's YAML, so give every inbound integration its own flow rather than sharing one hook URL. Revealing a URL needs the engineer role and is written to the audit log.