ThreatTalon Studio v1.1.9
Retro-sweep
An optional hourly job that searches your connected SIEMs' last seven days for newly reported high-score indicators. It queries only; nothing is ingested.
What it is
Threat → Retro-sweep (/threat-intel/retro-sweep) answers the question a new indicator raises: was it already in our data? When a threat feed delivers indicators scoring at or above the minimum score, the sweep searches the last seven days of your connected Splunk, Sentinel, Elastic and CrowdStrike SIEMs for them. Indicators count as new for 48 hours after they arrive.
Queries only. Each sweep is a read-only search in your SIEM's own language; Studio stores the hits, never the events.
Hits list the indicator, how many events matched, when it was first and last seen, and up to ten hosts. Hits only narrows the list.
Alerts. A hit sends a critical threat-intel notification, naming the indicators and hosts, to every destination watching threat intel. See Notifications.
Turning it on
1
Add at least one threat feed under Threat → Threat Feeds, and connect a SIEM.
2
On Threat → Retro-sweep, switch the sweep on. It is off by default.
3
Set the minimum score, a whole number from 1 to 100 (70 by default). Only indicators at or above it are swept, which keeps the SIEM searches small.
4
The next sweep runs within the hour, once a feed delivers new indicators.