Talon SOCTalon Studio v1.0.2-beta

The Queue

Where alerts land: pending alerts from every connected SIEM, CrowdStrike and ServiceNow, sorted by severity and mapped to the detection that fired them — open a case from each or dismiss it.

The alert queue

The Alert queue (/soc/queue) holds every pending alert from the workspaces you can see in the SOC. Each carries its source — Splunk notable, Sentinel incident, Elastic alert, Chronicle, XDR (CrowdStrike) or ServiceNow — and the queue is sorted by severity (critical first), then newest first.

Four cards count Pending alerts, those Mapped to a detection, those Unmapped (no Talon detection matched, which is normal for XDR and ServiceNow) and Critical / high. Filter by Severity, Workspace and Source, and export the filtered rows as CSV. Critical and high alerts that sit in the queue are tinted as they age.

Alerts arrive on their own

The scheduled pull runs every minute for every SOC-enabled workspace, and push webhooks deliver as alerts fire. Sync alerts runs the pull now across every SOC workspace you can operate in, and reports how many new alerts it recorded, which SIEMs failed (details in Settings → App Logs), and which may have more alerts than one pull captured.

Suppression rules

A suppression rule mutes new alerts for a detection or technique — optionally for one entity — for up to 30 days. Matching alerts land already dismissed, keeping the audit trail. Rules are managed through the API at /api/workspaces/{id}/soc/suppression-rules (engineer role on the workspace); there is no settings screen for them yet.

Triage actions

The queue is a decision point, not a resting place: every alert is either turned into a case or dismissed.

Open case. A real alert becomes a case, with raw fields, disposition, assignment and a timeline where an analyst works it.

Dismiss. Dismissing clears an alert from the queue. To record a false positive against the detection, open a case and set its disposition instead.

Read the mapping. Each row's detection and ATT&CK technique tell you at a glance whether an alert is worth a case or comes from a noisy rule due for tuning.

One action can clear several rows. Opening a case folds in every other pending alert that shares its detection and entity (or the entity alone, for unmapped alerts), so the queue count can drop by more than one.

Talon SOC → Queue

Triage in bulk: select alerts and use Promote selected or Dismiss selected — promoting folds any pending alerts that share the same detection and entity into one case.