Skip to content
DocumentationAPI ReferenceChangelog
Talon ForgeTalon Studio v1.0.2-beta

Library

Start from thousands of community detections instead of a blank page.

Content library

Browse 9,000+ indexed rules from SigmaHQ, Splunk Security Content, Microsoft Sentinel, Google SecOps Community and FalconForce FalconFriday at Talon Forge → Library (/forge/library). Filter by source, tactic, MITRE technique, deployability (Deployable or Needs data) or SIEM status (On SIEM or Not deployed); the Custom source lists your saved templates. Sigma rules come pre-translated, with tabs for Splunk, Elastic, Sentinel KQL, Chronicle, CrowdStrike and SentinelOne. Save to workspace adds a rule as a draft detection, staged in the workspace repo, ready to validate and deploy.

The library is filled by the content sync, which clones the public repositories from GitHub when Talon starts and checks them again every hour (CONTENT_SYNC_INTERVAL_MS). The same sync brings in Splunk's analytic stories, data sources, macros and lookups, Atomic Red Team tests and Stratus Red Team scenarios. An install that can't reach github.com, or that sets DISABLE_DETECTION_CONTENT_SYNC=true, gets no new content — so a fresh install in that state has an empty library.

Talon Forge → Library
A library rule opened in the detail panel, with the Explain this rule and Adapt to my environment AI actions and Save to workspace.
Provenance, and AI actions
Every rule is badged with the catalogue it came from, so provenance stays visible once a rule is in your workspace. Each rule carries two AI actions too: Explain this rule summarises what it catches and how, and Adapt to my environment has the assistant call list_streams to check your workspace's real sourcetypes and fields, then rewrite the rule and flag anything missing. Both open the Talon Claw assistant with the rule filled in, so they need an AI provider configured in Talon Claw → Settings.
Tip
Drive imports from an Atlas gap rather than browsing blind — clicking a gap surfaces the library rules that match your evidence, so you import detections your data can actually fire instead of ones that'll sit unvalidated.