Talon ReplayTalon Studio v1.0.2-beta

Talon Replay

Prove a detection fires on attack telemetry before you rely on it — replay sample events and recorded attacks against your rules, and catch regressions.

What it is

Talon Replay answers "would this have caught it?" Where Talon Monitor asks whether a rule can run in your SIEM, Replay records whether it actually fires on attack telemetry — the detection's own sample events, recorded Atomic Red Team attack data, or a whole Threat Scenario chain — so you trust it on evidence rather than on faith.

How it works

A simulation run takes one detection and one provider. On a detection's page, the Threat Simulation panel's Run simulation offers:

In-house (Sigma engine)

No SIEM needed. Runs the detection's Sigma rule against its own sample telemetry — the golden events and JSON attack data in its tests — through the pySigma sidecar. A native-only detection has nothing for it to evaluate.

Recorded replay (attack_data)

Splunk only. Ingests the detection's recorded attack data over HEC into the quarantined talon_range index on your Splunk test target, then runs the detection's SPL confined to that index. A pre-flight refuses the run, naming what to install, if the SPL needs macros, data models or lookups your Splunk lacks.

Live victim container

A scaffold today: it generates representative synthetic events tagged talon_simulated rather than executing real techniques, and needs a separate victim-runner container that the release Compose file doesn't include.

Each run reads detected, false coverage (telemetry arrived but the rule stayed silent — coverage that isn't real), no telemetry or error. Runs also happen without a click: when a change request merges, Talon replays the recorded attack data of the detections it merged, and skips silently when there's no Splunk test target or no attack data. The change request's own checks — Atomic Red Team telemetry and golden events — land on the Replay dashboard too.

Chains and history

To exercise a full attack chain, build a Threat Scenario and use Run replay: every stage's detection is evaluated in-house, in kill-chain order, with a chain verdict. To see how often a rule would have fired on real history instead, use Backtest on the detection's page — Splunk and Sentinel only, over the last seven days.

Setup

Give detections sample telemetry: golden events (and JSON attack data) in their tests are enough for in-house runs, with no SIEM at all.

For recorded replay, mark a Splunk connection as a Test target with a HEC endpoint and token (Talon Connect → SIEM). In the Community Edition that is your one SIEM connection, so simulation telemetry lands in its talon_range index, which Atlas leaves out of its coverage evidence.

Open /replay for the results dashboard, and /replay/threat-simulation to browse the Atomic Red Team and Stratus Red Team test catalogue.

Test target required for recorded replay

Recorded attack-data replay only runs when a Splunk connection is marked as the test target with an HEC endpoint and token — without one, the automatic replays skip silently, so an empty run history can just mean no test target is configured, not that nothing regressed. A manual run says so instead: "Mark a Splunk connection as the Test target (Connect → SIEM) to run simulations."

Usage

Read the dashboard: Replayed, Passing, Failing, Drift alerts, Not replayed and Last replay, then Replay Health (pass rate, replayed, drift-free), the drift alerts and Recent replay runs.

Use the Ask Talon Claw action on a failed run to triage it.

Use a passing run as evidence a rule works, and keep the recorded runs as an audit trail. Replay sources shows what is live — Atomic Red Team and Stratus Red Team — and what isn't yet: Lakehouse Samples (coming next) and Manual Payloads (planned).