Talon ForgeTalon Studio v1.0.2-beta
Adopt Detections
Bring rules that already live in your SIEM under Git-backed management.
Adopt from SIEM
At /forge/adopt, import the detections that already live on your connected SIEM — Splunk saved searches, Sentinel analytics rules, Elastic detection rules, Chronicle rules — as native Talon detections under Git-backed management: versioned, validatable and deployable like any Talon detection. Nothing on this page changes the SIEM, and disabling the native rule is always a deliberate, manual step.
The browser lists what the last sync imported, so Sentinel rules appear only once the connection has its Azure workspace identity, and Elastic rules only once it has a Kibana URL — see SIEM Connections.
Adopted rows are actually saved as native — the SIEM's query copied verbatim, no Sigma conversion — as a draft owned by siem-import.
Adoption is idempotent: re-running it skips detections already adopted, and Talon's own Splunk deploys (saved searches named "Talon - …") are hidden from the list. Talon's rules on Sentinel, Elastic and Chronicle carry the plain detection name and are not hidden, so leave them unticked.
Adopting immediately opens a change-request PR and kicks off validation on it — no separate manual step needed.
Tip
Watch the conformance-gap count on each row — rules are graded against your active standard as you browse, so adopt the clean ones first and treat the gapped ones as a scored clean-up worklist rather than importing everything at once.