SOCFortress Talon

Your AI Level 1 SOC analyst, built into CoPilot.

Talon picks up alerts from CoPilot and investigates them the way a good Level 1 analyst would: it pulls the raw event, checks the host, enriches every indicator, remembers what it has seen before and hands your team a clear report, ready to act on.

Request a demo Request a demo
See what Talon does Download the Talon brochure

Self-hosted next to CoPilot. Bring your own model, from commercial APIs to fully local.

InvestigatedSOCFortress Talon

Encoded PowerShell spawned by Word

  • Severity: High
  • Confidence 0.86
  • 4 IOCs
  1. Pulled the raw event from the Wazuh Indexer
  2. Checked the host and its vulnerabilities
  3. Enriched every IOC with threat intel

Escalated · quarantine proposed for approval

Illustrative example
The problem

Level 1 is where SOC hours disappear.

Most alerts need the same first look: open the event, check the host, look up the hash, search for related activity, write it up, decide whether to escalate. It is careful, repetitive work, and it never stops arriving.

  • Alert queues that grow faster than analysts can triage them.
  • Evidence spread across the SIEM, the EDR and a dozen intel tabs.
  • Context lost between shifts, analysts and customers.

What if every alert got a thorough first look before an analyst opened it?

Level 1, covered

Everything a Level 1 analyst does, from first look to hand-off.

Talon works inside CoPilot alongside your team. It takes the repetitive first pass on every alert and leaves the decisions that matter to your analysts.

  • Automatic or on demand

    Alert investigation

    Every alert gets a structured report: summary, raw event details, IOC analysis, SIEM correlation, severity assessment, confidence and recommended actions.

  • Severity-driven

    Escalation

    Critical, High and low-confidence findings are re-investigated on your strongest model, and reports can be routed by severity to Slack, Teams, email or ServiceNow.

  • Human-approved

    Endpoint quarantine

    Talon can propose quarantining or releasing a host through Velociraptor. An authorized analyst approves it in CoPilot, under their own login.

  • Wazuh & Velociraptor

    Host health and state

    Agent status and last check-in, OS, running processes, open ports, installed packages and the host’s critical vulnerabilities, all in the investigation.

  • AI Analyst overview

    SIEM stack health

    Talon checks its connections to the Wazuh Indexer, Wazuh manager, Velociraptor, threat intel and model providers, with uptime history and fix hints in CoPilot.

  • Human-approved

    Evidence collection

    Collect forensic artifacts like process lists, network connections, services, scheduled tasks and logons, or run a reviewed command, with results back in the chat.

  • Inside CoPilot

    Analyst chat

    Ask Talon about an alert, a host or a customer in named threads scoped to one customer, with live tool activity and approval cards as it works.

  • Per customer

    Memory

    Talon remembers lessons, false positives and asset history per customer, and learns from your analysts’ reviews, so the next investigation starts smarter.

  • No copy and paste

    Write-back to CoPilot

    Reports, severity, recommended actions and IOCs land on the alert in CoPilot automatically, so your team works from one place.

Capability card 1 of 0

Talon at a glance

Talon picks up an alert, investigates it with your SIEM stack tools, writes the report back to CoPilot and proposes the next step for your team to approve.

How it works

A thorough investigation, every time.

The steps that must never be skipped are run in code, not left to the model. The model is used where judgement is needed.

  1. 01

    Alert arrives

    CoPilot sends the alert automatically from its pipeline, or an analyst clicks Investigate with AI Analyst. Repeat alerts are de-duplicated.

  2. 02

    Gather the evidence

    Talon loads the raw event, the asset and customer, agent context, open vulnerabilities, earlier reports on the same alert or host, and relevant memories.

  3. 03

    Pick the playbook

    Investigation templates for Sysmon events, Windows Defender, Autoruns and Sigcheck tell Talon what matters for each alert type. Add your own as text files.

  4. 04

    Investigate

    Talon searches the SIEM, queries Velociraptor, enriches indicators with threat intel and correlates related activity, citing the evidence behind each claim.

  5. 05

    Check and escalate

    Every IOC must appear in the evidence, and a suspected test never lowers severity. Critical, High or uncertain findings are re-run on your strongest model.

  6. 06

    Report and remember

    The report and IOCs are written back to the alert in CoPilot, and what Talon learned is saved to that customer’s memory for next time.

The toolbelt

The SIEM stack tools a Level 1 analyst reaches for.

Talon investigates with typed tools wired into your SOCFortress stack. Every tool is read-only and bound to the customer under investigation.

Talon

Wazuh Indexer

Search, count and fetch events across the customer’s indices, including sources routed through Graylog.

  • Search events
  • Count events
  • Fetch event
  • Correlate activity

Wazuh manager

What the agent knows about the host behind the alert.

  • Agent status
  • Last keepalive
  • Processes
  • Open ports
  • Packages
  • Vulnerabilities

Velociraptor

Endpoint visibility and response, with collections and quarantine behind human approval.

  • Client info
  • Collection results
  • Hunts
  • Artifacts
  • Quarantine & release

CoPilot

The case history your analysts already built, read through a read-only connection.

  • Alerts
  • Assets
  • Prior AI reports
  • Analyst reviews
  • IOC sightings

Threat intel

Indicator and vulnerability enrichment, one validated indicator per lookup.

  • VirusTotal
  • MalwareBazaar
  • ThreatFox
  • AbuseIPDB
  • GreyNoise
  • URLScan.io
  • NVD
  • EPSS
  • CISA KEV
  • MITRE ATT&CK®

Analyst workspace

Room to work through large results without losing the thread.

  • Sandboxed shell
  • Web search
  • Paged results
  • Memory recall

Tool group card 1 of 0

Threat intel and web lookups are opt-in per customer. Some services need your own API keys and are subject to their own terms. Names are trademarks of their respective owners.

Memory

An analyst that remembers every customer.

A human analyst gets better with every shift. Talon does too. Each customer has its own memory, kept separate from every other customer, and it feeds straight back into the next investigation.

  • Learns from every investigation

    After each alert Talon saves a lesson, notes confirmed false positives and records which assets and IOCs were involved.

  • Learns from your analysts

    Lessons your team adds with Teach the Palace when reviewing a report are used in the next investigations for that customer.

  • Remembers in chat

    Ask Talon to remember a fact about a customer’s environment. It also keeps short notes on each analyst’s own threads and preferences.

  • Browse, search and forget

    See what Talon knows, by room and by asset, and why a memory is or isn’t used. Removing a lesson is audited.

Bring your own model

Plug in the language model that fits your SOC.

Talon is model-agnostic and works with many LLM providers. Choose a different model for each job, and decide per customer where their data may go.

  • Commercial models

    Frontier models from leading API providers, for the strongest reasoning on hard alerts.

    Anthropic Claude · OpenAI · more

  • Open-source models

    Open-weight models served through OpenAI-compatible runtimes, on infrastructure you choose.

    Ollama · vLLM

  • Local models

    Run the model on your own hardware next to CoPilot, and restrict a customer to local models only.

    On-prem · air-gap friendly

  • SOCFortress

    SOCFortress AI LM

    Plug Talon into the SOCFortress AI language model and skip running a model yourself.

    Provided by SOCFortress

  • Right model per job

    Separate models for investigations, escalations, template selection, chat and summaries. Use a small model where a small model will do.

  • Provider allowlists

    Allow each customer only the providers you agree with them, such as local models only. Checked before every model request.

  • Cost per alert

    Every model call is priced. See usage by customer, model and day, and the cost of each investigation in CoPilot.

  • Budgets

    Daily and monthly budgets per customer and per user, with a warning at 80% and runs that stop when a budget is reached.

Built for MSSPs

Guardrails in code, not in the prompt.

Talon is designed for multi-tenant SOCs. The rules that protect your customers are enforced by the software around the model.

  • Tenant isolation

    Every tool, memory and chat thread is bound to one customer. The customer always comes from the job, never from the model.

  • Anonymized by default

    Usernames, hostnames, emails and internal IPs are replaced with stable tokens before anything reaches the model, and restored only in that customer’s report.

  • Humans approve actions

    The model can only propose. Quarantine, alert changes and endpoint commands run after an authorized analyst approves them in CoPilot.

  • Evidence-checked reports

    Every IOC in a report must appear in the evidence, claims link back to tool calls, and a suspected pentest never lowers severity.

  • Prompt-injection aware

    Alert data is labelled as untrusted evidence, suspicious text is flagged, and the model has no write tools of its own.

  • Audit and safe rollout

    Full transcripts, tool calls and costs for every run. New customers start in shadow mode, and a kill switch stops automation at once.

Guardrail card 1 of 0

Where Talon fits

An extra analyst on the team you already have.

Talon runs inside SOCFortress CoPilot and works with your analysts. When you need more hands, our MDR team is there too.

Level 1, covered

Give every alert a thorough first look.

See Talon investigate alerts from your own SIEM stack inside CoPilot. We’ll help you choose a model, roll out in shadow mode and switch customers live when you’re ready.

Request a demo Request a demo
Download the Talon brochure

Frequently asked questions

Search keywords..
What is SOCFortress Talon?
Do I need CoPilot to use Talon?
Which language models does Talon support?
Can Talon quarantine a host on its own?
Does our data leave our environment?
Does Talon replace our analysts?
How do I get Talon?
Didn’t find the answer you were looking for?
Contact us, we’re here to help
Get in touch