Settings
Wire the SOC into the tools your team already uses — Slack, Teams and PagerDuty channels with per-event routing, Jira or ServiceNow tickets on true positives, and the on-call schedule.
Notification channels
/soc/settings → SOC Integrations manages delivery channels: Slack and Teams (incoming-webhook URL) and PagerDuty (Events API v2 routing key). Each channel picks its events — Case opened, Case assigned, Status changed, Disposition set, Case resolved, Comment added and SIEM health (a SIEM's alert pull going down or recovering) — plus a minimum severity (All (Info+), Warning+ by default, or Critical only) and an optional set of workspaces. Send test verifies delivery and records the channel as Connected or Failed.
Jira ticketing
A Jira connection (name, Jira base URL, account email, API token, project key, issue type) turns true positives into issues automatically: when a case's disposition is set to true_positive and it has no ticket yet, Talon creates [SOC] True positive: <case title> in the configured project with the case's severity, technique and ID, stores the key on the case, and logs it to the timeline. The first enabled Jira connection is used. Test connection checks the credentials. Jira is available on every edition.
ServiceNow ticketing
A ServiceNow connection (name, instance URL, username, password, and optionally an assignment group and caller as sys_ids) creates an incident for each true positive instead of a Jira issue — when both are enabled, ServiceNow wins. The incident's urgency and impact follow the case severity, and its number (INC…) is stored on the case. Every five minutes Talon checks those incidents, and when one is resolved, closed or cancelled in ServiceNow, the open case is marked resolved; a case is never reopened. SERVICENOW_TICKET_SYNC_INTERVAL_MS changes the interval and DISABLE_SERVICENOW_TICKET_SYNC=true turns it off.
On-call schedule
The On-call schedule panel is a schedule, not a paging rotation: add shifts (analyst, start, end, optional note — overlaps allowed), see who is on call now, and remove shifts as plans change. Changing it needs the admin role. The roster shows the resulting On call badges; nothing pages from here — that is what the PagerDuty channel is for.