Talon MonitorTalon Studio v1.0.2-beta

Rule Health

A live health grade for every rule installed in your SIEM — including the legacy rules Talon never authored — scored from real evidence: broken references, dead log sources, silent schedules and noisy triage outcomes.

What it is

The Rule Health tab on /validate is a ledger of every detection rule installed in the connected SIEM — Talon-managed and imported/legacy alike. Each rule gets a composite grade (healthy / degraded / broken / unknown) and a 0–100 score computed from live SIEM evidence, with per-signal chips explaining exactly why — hover any flag to read the reasons.

The honesty rule carries over from the rest of Talon: a signal that can't be measured reports unknown and is excluded from the score — never silently counted as healthy. A stacked Rule health trend chart above the ledger shows the grade mix moving over time, from daily snapshots, so you can prove the estate is getting healthier.

The grades are computed from live evidence each time the tab loads. The daily snapshots behind the trend chart, the regression history and Atlas's broken-rule demotion are written by the Claw cycle, so they only accumulate once an admin has switched on the Claw coordinator (Talon Claw → Settings, off by default); the chart appears once there are two days of history.

Installed rulesLegacy rulesGradesTrendEvidence-backed

The signal families

Four signal families feed the grade, each from a different kind of real evidence:

Broken references

The rule leans on a macro, lookup or sourcetype that doesn't exist (or has never carried an event) in the connected SIEM — it can never fire as written.

Staleness

A referenced log source that used to carry events has gone quiet (no events in 14+ days) — the rule used to work; its telemetry stopped.

Never fires

A scheduled rule with zero successful dispatches in 30 days — read from the SIEM's own scheduler history (Splunk-first), not inferred. Vendors with no scheduler history report unknown, never healthy.

Noise

A high false-positive rate across recent triage outcomes — at least 5 SOC dispositions/feedback in 30 days with ≥60% false positives. Works for legacy rules too: analyst verdicts map back by the rule's name.

Distinct failure modes, never double-counted

Broken references means the data never existed; staleness means it stopped flowing; never-fires means the rule runs but produces nothing. A genuinely dead sourcetype is flagged under one family, not penalised twice — and an unscheduled rule isn't punished for having no dispatches.

Coverage & AI mapping

A benchmarkable headline. The tab reports ATT&CK coverage using the industry-standard formula — the percentage of catalogue techniques with at least one enabled rule mapped to them — so you can compare your number directly against published industry averages, alongside Talon's deeper telemetry-evidence axis on Atlas.

Security-layer depth. Each rule's log sources classify it into defensive layers (endpoint, network, identity, email, cloud, application), and the headline shows how many techniques are covered at two or more distinct layers — coverage that survives one blind sensor.

AI-assisted ATT&CK mapping. Map unmapped with AI batches unmapped imported rules through your configured AI provider. Every suggested technique id must exist in the MITRE catalogue (a hallucination gate), and suggestions land as pending chips — a human clicks Apply per rule before coverage reads the mapping. Coverage never counts a raw suggestion.

Adopt & fix. An unhealthy imported rule links straight into the adoption flow, so the fix can be brought under Talon's Git-backed management rather than patched ad hoc in the SIEM.

Closing the loop

Rule health isn't just a report — it feeds the rest of the platform:

Claw proposals. With the Claw coordinator on, a rule with broken references (broken_reference, high priority) or a silent schedule (never_fires) raises a proposal in the Workboard's Proposed lane, routing the Detection Engineer to diagnose and propose the fix — a Sigma change request for Talon-managed rules, a concrete remediation plan for legacy ones. Propose-only, as always.

Regressions re-open; standing issues don't nag. Once you resolve or dismiss a finding, it stays resolved while the condition persists — it only re-opens if the rule recovers and then breaks again (a new episode in the snapshot history).

Atlas demotion. A technique is not counted as covered when its only covering rule's latest health snapshot grades it broken — a rule that can never fire is not coverage. Rules not yet graded keep counting: unknown is not broken.

screenshot — The Rule Health ledger: grade badges and signal chips per installed rule, the grade-mix trend above, and the coverage headline — techniques covered, percent, and how many hold at 2+ security layers. **Map unmapped with AI** queues mapping suggestions for human review.