Talon memory

Talon keeps a long-term memory per customer, and uses it at the start of every investigation and in chat. The Memory tab of the AI Analyst page shows that memory: how much there is, where it came from, what it says, and what Talon has learnt about each asset over time. It also shows your own chat memory.

---

​

What Talon stores

Talon’s memory is a set of short notes, called memories (a MemPalace “drawer” each), kept in one area per customer. A memory is text: a summary, a lesson, a fact about an asset. It is never a copy of raw logs. Memories Talon writes itself (from investigations and chat) are stored with the customer’s anonymized tokens in place of usernames, hostnames, email addresses and internal IP addresses. When you read one on the Memory tab, Talon restores the real values for that customer before CoPilot shows it to you.

​

Rooms

Each memory is filed in a room, by what it is about:

​

Where memories come from

---

​

Who sees what

• Customer memory: you see only the customers you are assigned to; admins see every customer. CoPilot checks the customer on every request, before Talon is asked.
• Your chat memory: only your own. Nobody else sees it, admins included.
• The Memory tab is for admins, analysts and responders, like the rest of the AI Analyst page’s Talon tabs.

---

​

The Memory tab

​

Customer memory

Choose a customer (the picker starts from the global customers filter, and from your one customer when you have only one). You see:

• Tiles: how many memories Talon holds for the customer, how many it filed in the last 30 days, and how many are hidden as testing. On a very large memory Talon stops counting at a limit, and the tiles say approximate.
• Filed per day: memories filed per UTC day over the last 30 days. Show the numbers gives the same figures as a table; a day Talon didn’t report shows “no data”, not 0.
• By room and By source: how the memories split. Select a row to filter the list below to it.
• Memories: the list, newest first, with filters for room, source and the days it was filed, and a search by meaning: it finds memories about what you describe, not only ones containing your words, so its results are the closest matches first, on one page. Load more fetches the next page of the list; with a source filter a page can be shorter than usual while there is still more.

Open a memory to see:

• its room, source and when it was filed;
• where it came from: links to the investigation’s job page and to the alert, when it came from one;
• why it is hidden, if it is (see below);
• its text, rendered as Markdown. Raw HTML in a memory is shown as text, and images are shown as links, never loaded;
• Forget, only when the memory may be forgotten.

​

Assets

The hosts Talon has recorded in the customer’s memory, with how many alerts it has linked to each. (IOCs per asset show no data yet: Talon doesn’t record them yet.) Choose one to see its timeline: each fact Talon learnt about it (“runs the nightly backup”, “is owned by IT operations”), from when it became true and, once something replaced it, until when.

​

My chat memory

What Talon remembers from your own chats: your preferences and the notes it keeps to answer you better. Each one can be forgotten.

---

​

Forgetting a memory

Forget removes a memory from Talon, so it is no longer recalled in investigations or chat. You can forget:

• a customer’s one-off review lessons and chat “remember” lessons;
• any item in your own chat memory.

You can’t forget an investigation’s own record or a durable lesson: the Forget button doesn’t appear for them, and CoPilot and Talon both refuse it. A durable lesson that is wrong is corrected by reviewing again and teaching a better one. Forget always asks you to confirm. Every forget that passes CoPilot’s access checks is recorded in CoPilot’s audit log as talon_memory.forget, with who, which customer and which memory, and its result: forgotten, refused (by CoPilot or Talon), or unknown when Talon didn’t answer in time (the memory may or may not be gone; refresh to check). A forget refused because you can’t see the customer, or with the Talon v2 setting off, isn’t. What forgetting does not do:

• It can’t be undone. An analyst can teach Talon the lesson again.
• It doesn’t change reports, reviews or IOC verdicts already written. A forgotten one-off review lesson stays in the review history, marked expired, as one past its time is.
• It doesn’t remove what an earlier investigation already concluded from that investigation’s own report.

---

​

Why some memories are hidden

Some memories are kept but not shown to investigations. The memory’s detail says why; in the list, a tag does. There are three reasons:

• Hidden: testing. A lesson that puts the activity down to testing (a red-team exercise, a breach-and-attack simulation, a penetration test, a drill). Investigations don’t see it; for a false-positive lesson, neither does Talon’s recall tool. A review lesson is hidden for this in any room. That is not because testing is harmless. Testing is never a reason to lower an alert’s severity: simulated attacks use real techniques, and an attacker can look exactly like a test. Talon investigates them as real threats. A lesson that says “this was only a test” must not teach later investigations to wave similar activity through, so it is kept out of them.
• Recall only. One-off review lessons, and other memories Talon didn’t write itself, are left out of the context an investigation starts with (it counts them, but doesn’t show them), though Talon’s recall tool can still find them when it searches. Durable review lessons are shown to investigations (up to three per investigation, anonymized first), unless they’re hidden as testing. This needs talon-analyst 0.1.4 or later; before it, every review lesson was recall only.
• Chat memory. A user’s own chat memory is per user: investigations never read it.

---

​

Related