Compose a detection from any starting point, test it against sample events, and watch it translate to your SIEM in real time.
Entry points
Open Talon Forge → Builder (/forge/builder). It is one Sigma-first builder, with several ways in:
Guided — a form for the log source (product, service, category), "all must match" field conditions, MITRE technique and severity. It writes Sigma for you; a rule it can't represent (a correlation, or several conditions) opens in the Sigma view instead.
Sigma — edit the Sigma YAML directly, with line-and-column YAML errors.
Splunk / Sentinel / Elastic / Chronicle — write a native query for one SIEM. It's saved as-is and not translated to the others.
Templates — built-in starting rules (Windows process creation, suspicious PowerShell, failed logon, Sysmon network connection, AWS CloudTrail sensitive API) and your own, saved with Save current as a template….
Start from a gap — a launcher that seeds the draft's name, log source and MITRE technique from a technique your telemetry can detect but doesn't cover yet.
Ask AI — Explain this draft, Tighten (reduce false positives), or Generate from description from the name and description you typed. These open the Talon Claw assistant, so they need an AI provider configured.
To bring over a rule that already lives in your SIEM, use Adopt Detections (/forge/adopt) instead. Map the MITRE technique and severity so the detection is validated and counted in coverage from the moment it's saved. An unsaved draft is kept in this browser, and the Builder offers to restore it next time.
Live preview
As you edit Sigma, the pySigma sidecar validates it and translates it into each connected SIEM's language — SPL, KQL, EQL or YARA-L — under Translates to (all four when no SIEM is connected). A green dot means that SIEM has a query; Customize lets you edit one SIEM's query by hand, and Reset to Sigma goes back to the translation.
Test against events — paste sample log events, mark each as should or should not fire, and Run test before saving (Sigma rules only).
Environment readiness — on a Splunk workspace, checks the SPL's indexes, sourcetypes, data models, macros and lookups against what your Splunk actually has. For other SIEMs the preview shows only whether the rule can be expressed.
Save detection writes Git-backed YAML into the workspace repo — staged on main, or committed onto your change-request branch when you're working on one; nothing deploys straight to production. If the Sigma sidecar is down, a Sigma save is refused rather than stored without its SIEM queries.
Talon Forge → Builder
The Sigma editor with the per-SIEM live preview. Check the translation for every connected target before saving, or use Start from a gap to seed the draft with a technique and log source.
Tip
Check the preview for every connected target before saving, not just your primary SIEM — a rule that compiles cleanly to Splunk SPL can still need a field-mapping tweak to render correctly in Sentinel KQL.