| 1 | --- |
| 2 | title: AI Analyst (Talon) |
| 3 | description: Automated Tier 1 SOC analyst that investigates every alert end-to-end — from raw SIEM events to structured investigation reports with severity assessments and recommended actions. |
| 4 | --- |
| 5 | |
| 6 | Talon is an automated AI SOC analyst built by [SOCFortress](https://www.socfortress.co/) for CoPilot. It runs as a background service alongside CoPilot — pulling raw events from your Wazuh/OpenSearch SIEM, enriching them with threat intelligence, correlating across your environment, and writing structured investigation reports with severity assessments and recommended actions directly back into CoPilot. |
| 7 | |
| 8 | <Card title="GitHub Repository" icon="github" href="https://github.com/taylorwalton/talon"> |
| 9 | Source code, deployment guide, and architecture docs. |
| 10 | </Card> |
| 11 | |
| 12 | --- |
| 13 | |
| 14 | ## What it does |
| 15 | |
| 16 | - **Automated Tier 1 investigations** — every OPEN alert is investigated end-to-end: SIEM raw event → IOC extraction → VirusTotal / Shodan / AbuseIPDB → MITRE ATT&CK correlation → structured report |
| 17 | - **Two trigger paths** — real-time via `POST /investigate` (CoPilot calls this when an alert is created) and a 15-minute scheduled sweep as a safety net |
| 18 | - **Writes back to CoPilot** — job status, full report, and enriched IOCs are persisted in CoPilot's database via its REST API; no direct database writes |
| 19 | - **Privacy-aware by default** — an anonymizing MCP proxy intercepts raw SIEM events and replaces PII (usernames, hostnames, internal IPs) with session tokens before they reach the cloud model; a built-in deanonymize tool restores real values in the final report |
| 20 | - **Optional local LLM analysis** — if [Ollama](https://ollama.com/) is running, the agent routes raw event interpretation through a local model instead of the cloud; no config needed if Ollama is on the same host |
| 21 | - **Alert-type prompt templates** — per-alert-type investigation guides (Sysmon Event 1, 3, 7, 11, 22) are loaded automatically based on the alert's `rule.groups` field; add new templates without touching code |
| 22 | |
| 23 | --- |
| 24 | |
| 25 | ## How it works |
| 26 | |
| 27 | ### Step 1 — Alert ingestion |
| 28 | |
| 29 | Talon picks up OPEN alerts via two paths: |
| 30 | 1. **Real-time webhook**: CoPilot calls `POST /investigate` when an alert is created |
| 31 | 2. **Scheduled sweep**: Every 15 minutes, Talon queries the CoPilot database for OPEN alerts with no existing investigation job |
| 32 | |
| 33 | ### Step 2 — SIEM correlation |
| 34 | |
| 35 | Talon queries OpenSearch/Wazuh for: |
| 36 | - The raw event that triggered the alert |
| 37 | - Correlated events across the same asset, time window, and rule groups |
| 38 | - Historical context from the 30-day lookback period |
| 39 | |
| 40 | ### Step 3 — IOC extraction & enrichment |
| 41 | |
| 42 | IOCs (IPs, file hashes, domains, user accounts, commands) are extracted from the raw events and enriched via: |
| 43 | - **VirusTotal** — file hash and domain reputation |
| 44 | - **Shodan** — IP exposure and service enumeration |
| 45 | - **AbuseIPDB** — IP abuse reports |
| 46 | |
| 47 | ### Step 4 — Report generation & write-back |
| 48 | |
| 49 | Talon generates a structured investigation report containing: |
| 50 | - Executive summary |
| 51 | - Attack timeline |
| 52 | - IOC analysis with verdicts |
| 53 | - SIEM correlation findings |
| 54 | - Severity assessment with justification |
| 55 | - Recommended actions |
| 56 | |
| 57 | The report, job status, and enriched IOCs are written back to CoPilot via the CoPilot MCP server. |
| 58 | |
| 59 | --- |
| 60 | |
| 61 | ## Architecture |
| 62 | |
| 63 | ``` |
| 64 | ┌──────────────────────────────────────────────────────┐ |
| 65 | │ CoPilot (FastAPI) │ |
| 66 | │ │ |
| 67 | │ Alert created → POST /investigate ──────────────┐ │ |
| 68 | │ GET /status, GET /jobs/:alertId ← Talon HTTP API│ │ |
| 69 | │ │ │ |
| 70 | │ Write-back API (MCP tools): │ │ |
| 71 | │ POST /api/ai_analyst/jobs ←───────────┘ │ |
| 72 | │ POST /api/ai_analyst/reports │ |
| 73 | │ POST /api/ai_analyst/iocs │ |
| 74 | │ MySQL: ai_analyst_job / report / ioc │ |
| 75 | └───────────────────────┬──────────────────────────────┘ |
| 76 | │ read-only MCP ▲ REST write-back |
| 77 | ▼ │ |
| 78 | ┌──────────────────────────────────────────────────────┐ |
| 79 | │ Talon (Node.js) │ |
| 80 | │ │ |
| 81 | │ HTTP channel (port 3100) │ |
| 82 | │ POST /investigate ← CoPilot triggers this │ |
| 83 | │ POST /message ← ad-hoc analyst prompts │ |
| 84 | │ GET /status ← queue + job overview │ |
| 85 | │ │ |
| 86 | │ Scheduled task (every 15 min) │ |
| 87 | │ Queries MySQL for OPEN alerts with no job row │ |
| 88 | │ Runs full investigation per alert │ |
| 89 | │ │ |
| 90 | │ SOC agent (containerized) │ |
| 91 | │ groups/copilot/CLAUDE.md ← investigation flow │ |
| 92 | │ groups/copilot/prompts/ ← per-alert templates │ |
| 93 | └──────────────────────────────────────────────────────┘ |
| 94 | │ MCP tools (read-only) |
| 95 | ▼ |
| 96 | ┌──────────────────────────────────────────────────────┐ |
| 97 | │ opensearch-mcp — raw SIEM queries │ |
| 98 | │ opensearch_anon — anonymizing proxy (PII→tokens) │ |
| 99 | │ mysql-mcp — CoPilot DB (alerts, assets) │ |
| 100 | │ copilot-mcp — CoPilot REST API write-back │ |
| 101 | │ ollama (optional) — local LLM for sensitive data │ |
| 102 | │ mempalace — persistent investigation memory │ |
| 103 | └──────────────────────────────────────────────────────┘ |
| 104 | ``` |
| 105 | |
| 106 | --- |
| 107 | |
| 108 | ## Privacy & anonymization |
| 109 | |
| 110 | Raw SIEM events contain sensitive data — usernames, internal hostnames, RFC1918 IPs. Talon's anonymizing MCP proxy intercepts all document and search results before they reach the Claude cloud API and replaces known PII fields with consistent session tokens: |
| 111 | |
| 112 | | Token pattern | What it replaces | |
| 113 | |---------------|------------------| |
| 114 | | `USER_1`, `USER_2`, … | Usernames, account names | |
| 115 | | `HOST_1`, `HOST_2`, … | Hostnames, computer names | |
| 116 | | `IP_INT_1`, … | Internal / RFC1918 IP addresses | |
| 117 | | `EMAIL_1`, … | Email addresses | |
| 118 | |
| 119 | Security-critical values — file hashes, external IPs, domains, process paths, rule metadata — pass through unchanged so threat intel lookups work normally. Before the final report is written, the agent calls a built-in `deanonymize` tool to restore real names and IPs so the analyst sees accurate output. |
| 120 | |
| 121 | Field definitions live in `siem/anon_proxy/fields.yaml` — add new fields and deploy to extend coverage. |
| 122 | |
| 123 | --- |
| 124 | |
| 125 | ## Local LLM support (Ollama) |
| 126 | |
| 127 | If [Ollama](https://ollama.com/) is running on the same host, Talon automatically routes raw event interpretation through a local model rather than the cloud. This keeps the most sensitive step — reading the full raw event and extracting IOCs — entirely on-premises. |
| 128 | |
| 129 | The agent checks for Ollama at startup. If it's not running, the investigation continues without it — no errors, no configuration required. |
| 130 | |
| 131 | ### Deployment options |
| 132 | |
| 133 | | Option | Hardware | Cost | Privacy | |
| 134 | |--------|----------|------|---------| |
| 135 | | **Local Ollama** | GPU required | $0 (sunk) | Best (fully on-prem) | |
| 136 | | **RunPod cloud GPU** | None | ~$0.20–0.44/hr | Good (PII already tokenized) | |
| 137 | | **Skip (cloud only)** | None | Per-investigation | Good (anonymized before cloud) | |
| 138 | |
| 139 | --- |
| 140 | |
| 141 | ## MemPalace persistent memory |
| 142 | |
| 143 | MemPalace gives the SOC agent long-term memory — past investigation outcomes, asset metadata, confirmed false positives, and IOC history are stored in a local ChromaDB + SQLite knowledge graph and retrieved automatically at the start of each investigation. |
| 144 | |
| 145 | This allows Talon to: |
| 146 | - Reference prior investigations for the same alert or asset |
| 147 | - Avoid redundant analysis for known-good patterns |
| 148 | - Track remediation status across repeated investigations |
| 149 | |
| 150 | --- |
| 151 | |
| 152 | ## CoPilot UI integration |
| 153 | |
| 154 | ### AI Analyst page |
| 155 | |
| 156 | Navigate to **Incident Management → AI Analyst** to access: |
| 157 | |
| 158 | | Tab | Purpose | |
| 159 | |-----|---------| |
| 160 | | **Overview** | Live status, architecture, capabilities, and integration details | |
| 161 | | **Reports** | Browse all investigation reports across all alerts | |
| 162 | | **Talon Chat** | Ad-hoc analyst prompts with SSE streaming responses | |
| 163 | |
| 164 | ### Alert-level integration |
| 165 | |
| 166 | When you open any alert in **Incident Management → Alerts**: |
| 167 | |
| 168 | 1. The **AI Analyst** tab appears next to Overview — if an investigation report exists, it auto-selects as the default tab with a pulsing indicator dot |
| 169 | 2. Reports show severity tag, summary, full markdown report, and recommended actions |
| 170 | 3. If multiple investigations exist for the same alert, a dropdown lets you switch between them (most recent first) |
| 171 | 4. The **"Investigate with AI Analyst"** button on the Overview tab triggers a new investigation on demand |
| 172 | |
| 173 | --- |
| 174 | |
| 175 | ## Alert-type templates |
| 176 | |
| 177 | Investigation templates live in `groups/copilot/prompts/`. Each file is a plain-text guide with template variables that the agent fills in at runtime. |
| 178 | |
| 179 | | File | Alert type | |
| 180 | |------|-----------| |
| 181 | | `sysmon_event_1.txt` | Process Creation (Sysmon Event 1) | |
| 182 | | `sysmon_event_3.txt` | Network Connection (Event 3) | |
| 183 | | `sysmon_event_7.txt` | Image Load / DLL (Event 7) | |
| 184 | | `sysmon_event_11.txt` | File Create (Event 11) | |
| 185 | | `sysmon_event_22.txt` | DNS Query (Event 22) | |
| 186 | |
| 187 | To add a new alert type, create the corresponding `.txt` file — no code changes required. The agent detects the type from `rule.groups` in the raw event and loads the matching template automatically. |
| 188 | |
| 189 | --- |
| 190 | |
| 191 | ## Deployment |
| 192 | |
| 193 | ### Prerequisites |
| 194 | |
| 195 | - Docker |
| 196 | - Node.js 20+ |
| 197 | - A running OpenSearch / Wazuh SIEM |
| 198 | - A running CoPilot instance (MySQL/MariaDB + FastAPI) |
| 199 | - A [Claude Code](https://claude.ai/download) OAuth token |
| 200 | |
| 201 | ### Quick start |
| 202 | |
| 203 | ```bash |
| 204 | git clone https://github.com/taylorwalton/talon.git talon |
| 205 | cd talon |
| 206 | npm install && npm run build |
| 207 | ``` |
| 208 | |
| 209 | Then configure credentials: |
| 210 | |
| 211 | ```bash |
| 212 | # SIEM (OpenSearch) |
| 213 | bash siem/setup.sh |
| 214 | |
| 215 | # CoPilot database |
| 216 | bash mysql/setup.sh |
| 217 | |
| 218 | # CoPilot REST API |
| 219 | bash copilot-mcp/setup.sh |
| 220 | |
| 221 | # MemPalace persistent memory |
| 222 | bash mempalace/setup.sh |
| 223 | |
| 224 | # Build the agent container |
| 225 | CONTAINER_RUNTIME=docker ./container/build.sh |
| 226 | ``` |
| 227 | |
| 228 | See the full [deployment guide](https://github.com/taylorwalton/talon#deployment-guide) for detailed steps including OAuth token setup, mount allowlist configuration, systemd/launchd service setup, and Ollama integration. |
| 229 | |
| 230 | ### Verify |
| 231 | |
| 232 | ```bash |
| 233 | # Health check (unauthenticated) |
| 234 | curl http://localhost:3100/health |
| 235 | |
| 236 | # Test SIEM connectivity |
| 237 | curl -s -N -X POST http://localhost:3100/message \ |
| 238 | -H "Content-Type: application/json" \ |
| 239 | -H "x-api-key: $TALON_API_KEY" \ |
| 240 | -d '{"message": "Check cluster health", "sender": "test"}' |
| 241 | ``` |
| 242 | |
| 243 | --- |
| 244 | |
| 245 | ## Key source files |
| 246 | |
| 247 | | File | Purpose | |
| 248 | |------|---------| |
| 249 | | `src/index.ts` | Orchestrator: message loop, agent invocation | |
| 250 | | `src/channels/http.ts` | HTTP channel: /investigate, /status, /jobs, /message | |
| 251 | | `src/task-scheduler.ts` | 15-minute scheduled alert sweep | |
| 252 | | `src/container-runner.ts` | Spawns agent containers with mounts | |
| 253 | | `groups/copilot/CLAUDE.md` | SOC agent investigation workflow | |
| 254 | | `groups/copilot/.mcp.json` | MCP server registry (opensearch, mysql, copilot, ollama) | |
| 255 | | `siem/anon_proxy/anon_proxy.py` | Anonymizing MCP proxy | |
| 256 | | `siem/anon_proxy/fields.yaml` | PII field definitions | |
| 257 | | `container/Dockerfile` | Agent container image | |
| 258 | |
| 259 | --- |
| 260 | |
| 261 | ## Per-deployment configuration |
| 262 | |
| 263 | | Path | Purpose | |
| 264 | |------|---------| |
| 265 | | `siem/.env` | OpenSearch credentials | |
| 266 | | `mysql/.env` | CoPilot MySQL credentials | |
| 267 | | `copilot-mcp/.env` | CoPilot REST API credentials | |
| 268 | | `ollama/.env` | Optional Ollama host override | |
| 269 | | `mempalace-data/` | MemPalace palace data (ChromaDB + SQLite) | |
| 270 | | `.env` | Claude OAuth token, webhook URL, HTTP API key | |
| 271 | | `groups/copilot/CLAUDE.md` | SOC agent identity, known assets, ongoing investigations | |
| 272 | | `groups/copilot/prompts/` | Per-alert-type investigation templates | |
| 273 | | `siem/anon_proxy/fields.yaml` | PII field definitions for the anonymizing proxy | |
| 274 | |
| 275 | --- |
| 276 | |
| 277 | ## Safety & guardrails |
| 278 | |
| 279 | - **Containerized isolation**: Each investigation runs in an isolated Linux container with a mount allowlist controlling file system access |
| 280 | - **No direct DB writes**: All data is written back via the CoPilot REST API with proper authentication |
| 281 | - **PII anonymization**: Sensitive data is tokenized before reaching any cloud model |
| 282 | - **Treat output as a draft**: AI-generated reports should be reviewed by an analyst before action |
| 283 | - **RBAC enforcement**: All CoPilot API endpoints require `admin` or `analyst` scope |
| 284 | |
| 285 | --- |
| 286 | |
| 287 | ## Video context |
| 288 | |
| 289 | - AI analyst (alert-context + exclusion-rule assistance): https://www.youtube.com/watch?v=-2srPC-Dw-0 |
| 290 | - AI chatbot + MCP-style "chat with your stack": https://www.youtube.com/watch?v=FHjD9QBaLD4 |
| 291 | - Expanded AI companion features: https://www.youtube.com/watch?v=QaLrmSgEcLI |
| 292 | --- |
| 293 | title: AI analyst / AI-assisted investigation |
| 294 | description: AI-assisted workflows to speed up alert triage, investigation, and knowledge capture across your open-source SIEM stack. |
| 295 | --- |
| 296 | |
| 297 | CoPilot’s AI features are designed to reduce context switching and speed up common SOC workflows: |
| 298 | - understand an alert faster ("what am I looking at?") |
| 299 | - decide what to do next ("benign or investigate?") |
| 300 | - generate drafts for repetitive engineering tasks (exclusions/tuning) |
| 301 | - chat with your stack (Wazuh, Velociraptor, CoPilot) using natural language |
| 302 | |
| 303 | --- |
| 304 | |
| 305 | ## What it is |
| 306 | |
| 307 | In the videos, AI in CoPilot shows up in two main ways: |
| 308 | |
| 309 | ### 1) AI analyst (alert-focused) |
| 310 | |
| 311 | AI analyst is embedded directly into CoPilot’s alert experience. |
| 312 | |
| 313 | Typical flow: |
| 314 | 1) Open an alert |
| 315 | 2) Select the impacted asset/hostname |
| 316 | 3) Use **AI analyst** to generate context and suggested next steps |
| 317 | |
| 318 | It can help: |
| 319 | - summarize what triggered the detection |
| 320 | - explain why the behavior can be suspicious |
| 321 | - suggest what to validate next (triage steps) |
| 322 | |
| 323 | The same area can also support workflows like drafting **Wazuh exclusion rules** for noisy/expected behavior. |
| 324 | |
| 325 | ### 2) AI chatbot / “chat with your stack” (tool-assisted) |
| 326 | |
| 327 | CoPilot can expose an AI chatbot that can interface with: |
| 328 | - **Wazuh Manager** |
| 329 | - **Wazuh Indexer (OpenSearch)** |
| 330 | - **Velociraptor** |
| 331 | - **CoPilot** |
| 332 | |
| 333 | This makes it possible to ask questions like: |
| 334 | - “show me recent alerts for customer X” |
| 335 | - “pull surrounding events for this index document” |
| 336 | - “run a Velociraptor artifact on host Y” |
| 337 | |
| 338 | …and have CoPilot handle the underlying API/tool calls. |
| 339 | |
| 340 | The chatbot can also be extended with additional “tools” (as shown in the videos), such as: |
| 341 | - threat intelligence lookups (IP/domain reputation) |
| 342 | - cyber news summaries |
| 343 | - internal knowledge base search/summarization |
| 344 | - high-level attack surface/exposure checks |
| 345 | |
| 346 | --- |
| 347 | |
| 348 | ## Why this is a power feature |
| 349 | |
| 350 | AI assistance is most valuable after your core stack is stable: |
| 351 | - alerts are flowing |
| 352 | - assets/customers are properly scoped |
| 353 | - investigation pivots work (index_id/index_name, artifacts, cases) |
| 354 | |
| 355 | Once that foundation is in place, AI can: |
| 356 | - reduce time-to-understanding for analysts |
| 357 | - standardize triage narratives |
| 358 | - accelerate tuning (without living in XML/rules all day) |
| 359 | |
| 360 | --- |
| 361 | |
| 362 | ## Operator workflows (practical) |
| 363 | |
| 364 | ### Triage an alert faster |
| 365 | |
| 366 | 1) Open the alert and review key fields (command line, parent process, user, host) |
| 367 | 2) Run **AI analyst** to get: |
| 368 | - a plain-English explanation of the detection |
| 369 | - what makes it suspicious |
| 370 | - recommended validation steps |
| 371 | 3) Decide: |
| 372 | - escalate/investigate further, or |
| 373 | - mark as expected (and consider tuning) |
| 374 | |
| 375 | ### Draft a Wazuh exclusion rule (noise reduction) |
| 376 | |
| 377 | If an alert is expected/benign but noisy: |
| 378 | 1) collect the key discriminators (image, command line pattern, user, parent, host group) |
| 379 | 2) generate a draft exclusion rule |
| 380 | 3) review it like code (avoid over-broad exclusions) |
| 381 | 4) deploy + validate |
| 382 | |
| 383 | ### Chat with your stack (investigation + response) |
| 384 | |
| 385 | Use the chatbot when you want to do “SOC glue work” quickly: |
| 386 | - ask questions against recent alerts |
| 387 | - pivot into index logs for context |
| 388 | - run Velociraptor collections/artifacts without leaving CoPilot |
| 389 | |
| 390 | --- |
| 391 | |
| 392 | ## Setup checklist (high level) |
| 393 | |
| 394 | Exact steps depend on your CoPilot release, but the videos show a common pattern: |
| 395 | |
| 396 | 1) **Update your CoPilot deployment** |
| 397 | - pull the latest images |
| 398 | - update `docker-compose.yml` with the new AI/MCP service (if required) |
| 399 | |
| 400 | 2) **Configure AI provider access** |
| 401 | - set your model provider API key(s) (example shown in the video: OpenAI) |
| 402 | |
| 403 | 3) **Configure stack connectivity for tool-assisted chat** |
| 404 | - Wazuh Indexer (OpenSearch) URL + credentials |
| 405 | - Wazuh Manager connection details (if used) |
| 406 | - Velociraptor connection details |
| 407 | |
| 408 | 4) **Validate permissions + scoping** |
| 409 | - ensure users can only summarize/ask questions over data they’re authorized to access (multi-tenant safety) |
| 410 | |
| 411 | --- |
| 412 | |
| 413 | ## Safety / guardrails |
| 414 | |
| 415 | - Don’t paste secrets into prompts. |
| 416 | - Treat AI output as a draft: verify before acting. |
| 417 | - Be careful with exclusion rules: tune precisely to avoid blinding detections. |
| 418 | - Restrict access: AI can summarize sensitive customer data; enforce RBAC/tenant scoping. |
| 419 | |
| 420 | --- |
| 421 | |
| 422 | ## Video context |
| 423 | |
| 424 | - AI analyst (alert-context + exclusion-rule assistance): |
| 425 | - https://www.youtube.com/watch?v=-2srPC-Dw-0 |
| 426 | |
| 427 | - AI chatbot + MCP-style “chat with your stack” (Wazuh/Indexer/Velociraptor/CoPilot): |
| 428 | - https://www.youtube.com/watch?v=FHjD9QBaLD4 |
| 429 | |
| 430 | - Expanded AI companion features (threat intel, cyber news, knowledge base search, exposure view): |
| 431 | - https://www.youtube.com/watch?v=QaLrmSgEcLI |