Skip to content
DocumentationAPI ReferenceChangelog
Talon ForgeTalon Studio v1.0.2-beta

Threat Scenarios

Chain existing detections into an ordered, risk-scored kill chain — a scenario raises one Splunk notable when a single risk object accrues risk across every stage inside a correlation window, instead of leaning on any one noisy rule.

Building a scenario

1
Open /forge/scenarios and create a scenario: name it, then add at least two stages — each stage is an existing workspace detection, in kill-chain order, with an optional label.
2
Pick the correlation window (1h / 4h / 24h / 72h) and the risk threshold (0–1000, default 60) the accrued risk must cross.
3
Save as Draft to keep editing freely, or Active to compile it into the deploy package — activation requires every stage to carry a MITRE technique and a risk model, and the error names the first stage that doesn't.

Scenarios are Git-backed like everything else — each is versioned as JSON under Talon/threat-scenarios/ in the workspace repo.

Preview, replay & deploy

Preview compiled artifact shows the exact Splunk risk-incident saved search a scenario becomes — compiled against the live state of its stage detections, with warnings when a stage has lost its technique or risk model since you saved. Active scenarios are recompiled into the bundled Splunk app on every deploy; a scenario that can't compile is skipped, never a deploy blocker.

Run replay (in the scenario's row menu) tests the chain without any SIEM: each stage's detection runs its Sigma rule against its own sample telemetry — golden events and JSON attack data — in kill-chain order. Each stage reads detected, false coverage (telemetry arrived but the rule stayed silent), no telemetry or error, and the chain reads Chain detected, Chain broken or No telemetry. Run history keeps past verdicts, and a chain that used to fire and no longer does is flagged as regressed.

Deploys to Splunk only
The compiled artifact is a Splunk risk-incident search — there is no scenario deploy artifact for other SIEMs yet. And despite the shared word, Threat Scenarios are not the Atomic Red Team and Stratus Red Team "scenarios" in Talon Replay's catalogue: a Threat Scenario is your own chain of detections that raises a notable in production.