Skip to content
DocumentationAPI ReferenceChangelog
Talon ForgeTalon Studio v1.0.2-beta

Talon Forge

Author detections as code in Sigma or native SIEM queries, with live translation to your SIEM's query language, a content library and templates to start from.

What it is

Talon Forge is the detection builder. Author in Sigma or a native query (SPL, KQL, EQL, YARA-L), adopt an existing SIEM rule, or let Claw draft one — then Forge translates it to your SIEM's native language and stores it as Git-backed YAML in the workspace repo. Edits stage to the working tree; author on a branch (or turn on the workspace's Require change requests setting, which blocks direct saves to main) to route them through change-request review — agent-drafted edits always arrive that way. Detections never deploy straight to production.

SigmaSPL / KQL / EQL / YARA-LGit-backed YAMLTemplatesStandards

How it works

Each detection is one YAML file in the workspace repo — Talon/detections/<technique>_<name>.yaml in new workspaces (workspaces created before the Talon/ layout keep detections/ at the repo root). The Sigma rule is the canonical source; the pySigma sidecar translates it, and the per-SIEM queries are stored beside it:

Talon/detections/T1003.001_mimikatz-lsass-access.yaml
schema_version: "1.0"
managed_by: Talon Studio
name: Mimikatz LSASS Access
mitre_technique: T1003.001
severity: high
status: draft
queries:
sigma: |
title: Mimikatz LSASS Access
logsource: { product: windows, category: process_access }
…
splunk: … translated SPL …
sentinel: … translated KQL …
elastic: … translated EQL …
yara_l: … translated YARA-L …
tests: []
# plus description, data_sources, references, risk, validation, deployment, x_splunk …
Entry points — the Builder (a guided form, a Sigma editor, or a native query per SIEM), the Ask AI copilot, the content library, or Adopt Detections (bring the rules already living on a connected SIEM under Git-backed management — imported verbatim as native detections, no Sigma conversion).
Library — 9,000+ rules from five public catalogues (SigmaHQ, Splunk Security Content, Microsoft Sentinel, Google SecOps Community and FalconForce FalconFriday) to browse and save as drafts.
Templates — built-in starting rules in the Builder's Templates menu, plus your own saved ones.
Standards — a conformance spec (required fields, minimums, a naming pattern) that detections are graded against. Enforcement is per standard: warn shows non-conformance on a change request, block stops it merging.

Setup

1
Have a workspace and at least one connected SIEM (so Forge knows your sourcetypes and which query languages to show).
2
Open /forge for the overview, /forge/detections for the inventory, or /forge/builder to create a new detection.
3
Set your detection Standards at /forge/standards so new rules are graded against them.

Usage

1
Start from a template, the library, or a blank Sigma or native rule; map the MITRE technique and severity.
2
Watch the Translates to preview render your rule in each connected SIEM's query language.
3
Save — Forge stages the Git-backed YAML into the workspace repo's working tree. Commit it, or author on a branch and open a change request for review; the change request's checks run on every commit to it.
4
Merge the change, then deploy through the release pipeline. The Community Edition deploys from main only.
Tip
Always map the MITRE technique before saving — it's what lets change-request validation find an Atomic Red Team test to run against and what turns the matching Atlas cell green, so an unmapped rule silently skips both.