Automated Tier 1 SOC analyst that investigates every alert end-to-end — from raw SIEM events to structured investigation reports with severity assessments and recommended actions.
Use this file to discover all available pages before exploring further.
Talon is an automated AI SOC analyst built by SOCFortress for CoPilot. It runs as a background service alongside CoPilot — pulling raw events from your Wazuh/OpenSearch SIEM, enriching them with threat intelligence, correlating across your environment, and writing structured investigation reports with severity assessments and recommended actions directly back into CoPilot.
GitHub Repository
Source code, deployment guide, and architecture docs.
Automated Tier 1 investigations — every OPEN alert is investigated end-to-end: SIEM raw event → IOC extraction → VirusTotal / Shodan / AbuseIPDB → MITRE ATT&CK correlation → structured report
Two trigger paths — real-time via POST /investigate (CoPilot calls this when an alert is created) and a 15-minute scheduled sweep as a safety net
Writes back to CoPilot — job status, full report, and enriched IOCs are persisted in CoPilot’s database via its REST API; no direct database writes
Privacy-aware by default — an anonymizing MCP proxy intercepts raw SIEM events and replaces PII (usernames, hostnames, internal IPs) with session tokens before they reach the cloud model; a built-in deanonymize tool restores real values in the final report
Optional local LLM analysis — if Ollama is running, the agent routes raw event interpretation through a local model instead of the cloud; no config needed if Ollama is on the same host
Alert-type prompt templates — per-alert-type investigation guides (Sysmon Event 1, 3, 7, 11, 22) are loaded automatically based on the alert’s rule.groups field; add new templates without touching code
Raw SIEM events contain sensitive data — usernames, internal hostnames, RFC1918 IPs. Talon’s anonymizing MCP proxy intercepts all document and search results before they reach the Claude cloud API and replaces known PII fields with consistent session tokens:
Token pattern
What it replaces
USER_1, USER_2, …
Usernames, account names
HOST_1, HOST_2, …
Hostnames, computer names
IP_INT_1, …
Internal / RFC1918 IP addresses
EMAIL_1, …
Email addresses
Security-critical values — file hashes, external IPs, domains, process paths, rule metadata — pass through unchanged so threat intel lookups work normally. Before the final report is written, the agent calls a built-in deanonymize tool to restore real names and IPs so the analyst sees accurate output.Field definitions live in siem/anon_proxy/fields.yaml — add new fields and deploy to extend coverage.
If Ollama is running on the same host, Talon automatically routes raw event interpretation through a local model rather than the cloud. This keeps the most sensitive step — reading the full raw event and extracting IOCs — entirely on-premises.The agent checks for Ollama at startup. If it’s not running, the investigation continues without it — no errors, no configuration required.
MemPalace gives the SOC agent long-term memory — past investigation outcomes, asset metadata, confirmed false positives, and IOC history are stored in a local ChromaDB + SQLite knowledge graph and retrieved automatically at the start of each investigation.This allows Talon to:
Reference prior investigations for the same alert or asset
Avoid redundant analysis for known-good patterns
Track remediation status across repeated investigations
Investigation templates live in groups/copilot/prompts/. Each file is a plain-text guide with template variables that the agent fills in at runtime.
File
Alert type
sysmon_event_1.txt
Process Creation (Sysmon Event 1)
sysmon_event_3.txt
Network Connection (Event 3)
sysmon_event_7.txt
Image Load / DLL (Event 7)
sysmon_event_11.txt
File Create (Event 11)
sysmon_event_22.txt
DNS Query (Event 22)
To add a new alert type, create the corresponding .txt file — no code changes required. The agent detects the type from rule.groups in the raw event and loads the matching template automatically.
See the full deployment guide for detailed steps including OAuth token setup, mount allowlist configuration, systemd/launchd service setup, and Ollama integration.
title: AI analyst / AI-assisted investigation
description: AI-assisted workflows to speed up alert triage, investigation, and knowledge capture across your open-source SIEM stack.
CoPilot’s AI features are designed to reduce context switching and speed up common SOC workflows:
understand an alert faster (“what am I looking at?”)
decide what to do next (“benign or investigate?”)
generate drafts for repetitive engineering tasks (exclusions/tuning)
chat with your stack (Wazuh, Velociraptor, CoPilot) using natural language
