TeamsTalon Studio v1.1.9

Links, agents & automations

Link cards, detections, cases, hunts, runs, change requests, automations and CVEs into a message, bring in a Claw agent, and run automations that post their results back.

Record links

Type [[, or press the link button in the message box, to search for a card, detection, case, hunt, agent run, change request or automation and drop a link to it. A bare CVE ID such as CVE-2024-3400 becomes a link on its own. Each link shows as a chip with the record's title and its live state, worked out for whoever is reading: someone without access to the record gets a restricted chip with no title, so a link never gives away what it names. A chip turns red when the record needs attention: a failed run, a degraded or failing detection, or a CVE on CISA KEV, with its ransomware flag.

Messages are up to 8,000 characters. @ mentions a person or an agent, and a mention of you raises a toast and counts toward the purple unread badge.

Pictures, previews & GIFs

Pictures. Add up to six per message with the picture button, or paste or drop them in. Each can be up to 10 MB; Studio re-encodes it to WebP and stores it under TALON_UPLOADS_DIR.

Link previews. A link unfolds into a card with the page's title, description and picture, and a message that is only an image or GIF link shows just the picture. Studio fetches the page itself, through its outbound URL guard, and caches the preview for six hours. Set TALON_TEAMS_LINK_PREVIEWS=false to turn previews off.

GIFs. An admin pastes a free GIPHY API key (from developers.giphy.com) into the Teams card on Settings → Organisation. Studio checks the key with GIPHY when it is saved and never shows it again. Once a key is saved, the message box has a GIF button; searches go through Studio, not the browser.

Claw agents

Mention an agent, such as @threat-hunter, and it answers in the conversation, up to three agents per message. Each reply is a governed agent run (trigger teams_chat), so it is budgeted, audited and propose-only like any other, and View the run in Claw → Agents under the reply opens it. Agents in direct messages and private channels run at organisation level. Bringing an agent in needs claw:operate and a configured AI provider. See Agents.

Automations

Automations can be started from a conversation, and they can write into one.

Run one from chat. The Run an automation button in the message box lists the workspace's automations. Pick one and it runs; when it finishes it posts back into the same channel or direct message what happened: what its AI or agent step said, any change requests it staged, or why it stopped. It needs the same Operate · Automations permission as the Run button in Flow.

Post from any automation. The Flow step Post to a Teams channel writes a message into one of the workspace's channels, by name, or into the workspace's own private channel when the name is left empty. Write [[card:<id>]], [[cr:<id>]] or a CVE ID to link a record. A test run says where it would post and posts nothing. See Nodes.

The Run an automation picker in Teams listing three automations, above a message posted by an automation — The **Run an automation** picker over the message box. The post above it is an automation's result, written by a Post to a Teams channel step.