Talon ThreatTalon Studio v1.0.2-beta

Adversaries

ATT&CK threat groups and campaigns mapped against your workspace's detection coverage — who could hit you, what they use, and the highest-leverage gaps to close first.

The four tabs

Adversaries (/threat-intel/adversaries) reads MITRE ATT&CK's Enterprise groups, campaigns and their technique usage, synced from MITRE's STIX data, and scores them against the active workspace. The search box filters the lists by name, alias or ID.

Threat groups

Every ATT&CK group with its technique count and coverage (covered/total). Groups on your profile's priority-actor list are badged Pinned, and groups matching its sector or regions are badged Relevant; both sort to the top.

Campaigns

The same view for ATT&CK campaigns, with an Attributed to column naming each campaign's group.

Priorities

Techniques ranked by how many groups and campaigns use them, uncovered first — the highest-leverage detections to build. Rows open the technique in Atlas.

Centrality

The most-connected entities on the workspace's knowledge graph — most-referenced techniques, most-connected groups and campaigns — counting every connection (technique, adversary, detection, telemetry), not just adversary usage.

Clicking a group or campaign opens a detail sheet: the MITRE description, aliases, attribution, coverage, MITRE's procedure examples, and the full technique list — each badged Covered or Gap and linking straight into Atlas.

Working the page

Select a workspace: coverage is scored per workspace, and the page asks for one before it shows anything.

Pin your priority actors in the Threat Profile so the groups you care about sort to the top and weight into readiness.

Work the Priorities tab top-down: uncovered techniques used by many adversaries are the best detections to build next.

What counts as covered

A technique is covered when a saved Talon detection maps to it, or an enabled rule imported from the connected SIEM does — the same definition Atlas uses. Sub-technique coverage rolls up to the parent. The numbers come from the workspace's cached coverage data, never a live SIEM query, so they reflect the last sync. The list is empty until the ATT&CK sync has run.