Talon ThreatTalon Studio v1.0.2-beta

Threat Profile

Tell Talon what you actually run — applications, operating systems, cloud platforms, sector and regions — so KEV relevance, adversary ranking and the readiness score reflect your environment, not the whole catalogue.

What's in a profile

The profile form at /threat-intel/profile captures your environment:

Key applications & vendors

A searchable picker of the vendors and products in the KEV catalogue (you can also add your own). Drives which known-exploited CVEs count as relevant to you.

Operating systems / Cloud platforms

Multi-select chips — the other two relevance signals.

Sector & Organisation size

Single selects. Sector seeds which threat actors are ranked as relevant.

Regions of operation

Surfaces the nation-state actors most active against those regions.

Priority threat actors

Groups you want tracked as must-watch — pinned to the top of Adversaries and weighted into the readiness score.

Compliance frameworks

Recorded on the profile for context and reporting. They do not affect scoring.

Scope & inheritance

Two scopes. The toggle at the top saves the profile for the Organisation (the default every workspace inherits) or for This workspace. Editing the organisation default needs the admin role; a workspace profile needs engineer on that workspace.

Whole override, not a merge. A complete workspace profile replaces the organisation default entirely; fields from the default are not merged in. The one exception: per-CVE priority pins, which always belong to the workspace, apply on top of whichever profile wins.

Versioned in Git. Saving updates scoring at once and writes the profile as a pending change — Talon/threat-intelligence/threat-profile.yaml in the workspace repository, or Org/threat-intelligence/threat-profile.yaml for the organisation default. Commit it to keep it; discarding the pending change reverts the profile.

Completing it

A profile is complete — the badge reads Completed rather than Uncompleted — once it names at least one key application, operating system or cloud platform. Sector, regions and priority actors refine which adversaries are ranked, but do not complete it on their own. Until an effective profile exists (the workspace's own, or the inherited organisation default), Threat Readiness asks for one instead of scoring.

Fastest path

Set the organisation default once as an admin: every workspace inherits it and Readiness starts scoring everywhere. Add workspace profiles later only where an environment genuinely differs. One exception: Talon Claw's standing KEV-gap proposals read only a workspace's own profile, so set one on each workspace where you want them.