SOCFortress Talon
Your AI Level 1 SOC analyst, built into CoPilot.
Talon picks up alerts from CoPilot and investigates them the way a good Level 1 analyst would: it pulls the raw event, checks the host, enriches every indicator, remembers what it has seen before and hands your team a clear report, ready to act on.
Self-hosted next to CoPilot. Bring your own model, from commercial APIs to fully local.
- Pulled the raw event from the Wazuh Indexer
- Checked the host and its vulnerabilities
- Enriched every IOC with threat intel
Level 1 is where SOC hours disappear.
Most alerts need the same first look: open the event, check the host, look up the hash, search for related activity, write it up, decide whether to escalate. It is careful, repetitive work, and it never stops arriving.
- Alert queues that grow faster than analysts can triage them.
- Evidence spread across the SIEM, the EDR and a dozen intel tabs.
- Context lost between shifts, analysts and customers.
What if every alert got a thorough first look before an analyst opened it?
Everything a Level 1 analyst does, from first look to hand-off.
Talon works inside CoPilot alongside your team. It takes the repetitive first pass on every alert and leaves the decisions that matter to your analysts.
- Alert investigationEvery alert gets a structured report: summary, raw event details, IOC analysis, SIEM correlation, severity assessment, confidence and recommended actions.Automatic or on demand
- EscalationCritical, High and low-confidence findings are re-investigated on your strongest model, and reports can be routed by severity to Slack, Teams, email or ServiceNow.Severity-driven
- Endpoint quarantineTalon can propose quarantining or releasing a host through Velociraptor. An authorized analyst approves it in CoPilot, under their own login.Human-approved
- Host health and stateAgent status and last check-in, OS, running processes, open ports, installed packages and the host’s critical vulnerabilities, all in the investigation.Wazuh & Velociraptor
- SIEM stack healthTalon checks its connections to the Wazuh Indexer, Wazuh manager, Velociraptor, threat intel and model providers, with uptime history and fix hints in CoPilot.AI Analyst overview
- Evidence collectionCollect forensic artifacts like process lists, network connections, services, scheduled tasks and logons, or run a reviewed command, with results back in the chat.Human-approved
- Analyst chatAsk Talon about an alert, a host or a customer in named threads scoped to one customer, with live tool activity and approval cards as it works.Inside CoPilot
- MemoryTalon remembers lessons, false positives and asset history per customer, and learns from your analysts’ reviews, so the next investigation starts smarter.Per customer
- Write-back to CoPilotReports, severity, recommended actions and IOCs land on the alert in CoPilot automatically, so your team works from one place.No copy and paste
A thorough investigation, every time.
The steps that must never be skipped are run in code, not left to the model. The model is used where judgement is needed.
The SIEM stack tools a Level 1 analyst reaches for.
Talon investigates with typed tools wired into your SOCFortress stack. Every tool is read-only and bound to the customer under investigation.
Wazuh Indexer
Search, count and fetch events across the customer’s indices, including sources routed through Graylog.
Wazuh manager
What the agent knows about the host behind the alert.
Velociraptor
Endpoint visibility and response, with collections and quarantine behind human approval.
CoPilot
The case history your analysts already built, read through a read-only connection.
Threat intel
Indicator and vulnerability enrichment, one validated indicator per lookup.
Analyst workspace
Room to work through large results without losing the thread.
Threat intel and web lookups are opt-in per customer. Some services need your own API keys and are subject to their own terms. Names are trademarks of their respective owners.
Plug in the language model that fits your SOC.
Talon is model-agnostic and works with many LLM providers. Choose a different model for each job, and decide per customer where their data may go.
- SOCFortress
SOCFortress AI LM
Plug Talon into the SOCFortress AI language model and skip running a model yourself.
Provided by SOCFortress
Right model per job
Separate models for investigations, escalations, template selection, chat and summaries. Use a small model where a small model will do.
Provider allowlists
Allow each customer only the providers you agree with them, such as local models only. Checked before every model request.
Cost per alert
Every model call is priced. See usage by customer, model and day, and the cost of each investigation in CoPilot.
Budgets
Daily and monthly budgets per customer and per user, with a warning at 80% and runs that stop when a budget is reached.
Guardrails in code, not in the prompt.
Talon is designed for multi-tenant SOCs. The rules that protect your customers are enforced by the software around the model.
Tenant isolation
Every tool, memory and chat thread is bound to one customer. The customer always comes from the job, never from the model.
Anonymized by default
Usernames, hostnames, emails and internal IPs are replaced with stable tokens before anything reaches the model, and restored only in that customer’s report.
Humans approve actions
The model can only propose. Quarantine, alert changes and endpoint commands run after an authorized analyst approves them in CoPilot.
Evidence-checked reports
Every IOC in a report must appear in the evidence, claims link back to tool calls, and a suspected pentest never lowers severity.
Prompt-injection aware
Alert data is labelled as untrusted evidence, suspicious text is flagged, and the model has no write tools of its own.
Audit and safe rollout
Full transcripts, tool calls and costs for every run. New customers start in shadow mode, and a kill switch stops automation at once.
See exactly how Talon works.
The CoPilot documentation covers Talon end to end, from the investigation pipeline and privacy model to installation and day-to-day review.
AI Analyst overview
What Talon does, how an investigation runs, privacy and tenancy, chat, budgets and guardrails.
Installing Talon
Prerequisites, the guided install and a shadow-first rollout, customer by customer.
Health dashboard
Component status, uptime history, investigation metrics and fix hints in CoPilot.
Memory
How Talon remembers each customer, and how to browse, search and forget lessons.
Analyst review workflow
Grade reports, correct IOC verdicts, replay with another template and teach Talon lessons.
Notification routing
Route reports per customer to Slack, Teams, email, ServiceNow and more, filtered by severity.
An extra analyst on the team you already have.
Talon runs inside SOCFortress CoPilot and works with your analysts. When you need more hands, our MDR team is there too.
- Learn more
The platform
SOCFortress CoPilot
One place to manage alerts, cases and the open-source security stack behind them.
Your AI Level 1 analyst
SOCFortress Talon
Investigates alerts, enriches indicators, remembers each customer and proposes the next step.
- Learn more
For when you need hands on deck
Managed Detection & Response
Our SOC extends your existing SIEM stack and team to detect, investigate and respond.
Give every alert a thorough first look.
See Talon investigate alerts from your own SIEM stack inside CoPilot. We’ll help you choose a model, roll out in shadow mode and switch customers live when you’re ready.