Talon ReplayTalon Studio v1.0.2-beta
Threat Simulation
Browse the Atomic Red Team and Stratus Red Team test catalogue by platform and technique — the attack telemetry Talon's validation and replay draw on.
What it does
Talon Replay → Threat Simulation (/replay/threat-simulation) is a catalogue, not a launcher. Its two tabs list the Atomic Red Team tests and the Stratus Red Team cloud attack scenarios that the content sync pulled in, so you can see what attack telemetry exists per technique. Nothing runs from this page: Atomic tests feed change-request validation, and simulations are started from a detection's page or run automatically on merge — see Talon Replay.
Browsing the catalogue
1
On the Atomic Red Team tab, search by technique ID, name or test name, and filter by platform — Windows, Linux or macOS (several at once). Tests are grouped by technique; expand a group to see its tests, or use Expand all.
2
On the Stratus Red Team tab, scenarios are grouped by cloud platform (AWS, Azure, GCP, Kubernetes, Okta), each with its MITRE technique and tactic. If it reads "No Stratus scenarios synced yet", the content sync hasn't pulled the Stratus repository.
3
Read the results on Replay's dashboard — the misses are concrete gaps to close in Forge.
Availability
Recorded replay ingests a detection's real recorded attack telemetry and checks your rule fires on it — real data, available today, on a Splunk test target. The live victim container currently emits representative stand-in events per technique (tagged talon_simulated); executing the actual Atomic Red Team commands in the victim is the planned next phase. Stratus scenarios appear in the catalogue but can't be run.
Under the hood
The Atomic Red Team catalogue comes from the content sync, so on a fresh install that can't reach GitHub, or runs with DISABLE_DETECTION_CONTENT_SYNC=true, it stays empty. Splunk-backed runs pre-flight the detection for missing macros, data models or lookups before firing, with an actionable message telling you which app to install (for example Splunk ESCU) and to re-sync the connection.