Talon Deployment Guide

SOCFortress handles the full server-side installation of Talon. There is one step that must be completed by the client: generating and adding a personal Claude OAuth token. This article explains the split of responsibilities and walks through every step of the process.

Overview

Talon is an automated AI SOC analyst built by SOCFortress. It integrates with the CoPilot stack, pulling raw events from your Wazuh/OpenSearch SIEM, enriching them with threat intelligence, and writing structured investigation reports back into CoPilot.

Because Talon uses the Claude Code API to power its AI analysis, each deployment requires a Claude OAuth token tied to a Claude account. SOCFortress cannot generate this on the client's behalf — the token is personal to the account holder and must be created and added by the client.

Responsibilities at a Glance

What SOCFortress Handles

SOCFortress completes the following steps before handing over to the client. No action is required from the client for any of these.

• ✓Clone the Talon repository to /opt/talon and run npm install && npm run build
• ✓Create /opt/talon/.env with all fields pre-populated (OAuth token placeholder left for client)
• ✓Configure the mount allowlist at ~/.config/nanoclaw/mount-allowlist.json
• ✓Run bash siem/setup.sh and populate siem/.env with OpenSearch credentials
• ✓Run bash mysql/setup.sh and populate mysql/.env with CoPilot database credentials
• ✓Run bash copilot-mcp/setup.sh and populate copilot-mcp/.env
• ✓Run bash wazuh-mcp/setup.sh and populate wazuh-mcp/.env
• ✓Run bash velociraptor-mcp/setup.sh and copy api.config.yaml
• ✓Run bash mempalace/setup.sh and verify MemPalace builds successfully
• ✓Build the agent container: CONTAINER_RUNTIME=docker ./container/build.sh
• ✓Install and enable the talon.service systemd unit
• ✓Verify /health endpoint responds before handover

What the Client Handles

After SOCFortress completes the installation, the client needs to complete one task: generate a Claude OAuth token and add it to the .env file.

Full Deployment Steps

git clone https://github.com/taylorwalton/talon.git /opt/talon
cd /opt/talon
npm install && npm run build

# /opt/talon/.env
CLAUDE_CODE_OAUTH_TOKEN=YOUR_TOKEN_HERE # ← client fills this in
HTTP_API_KEY=
# WEBHOOK_URL=...
# CREDENTIAL_PROXY_HOST=127.0.0.1

systemctl restart talon
curl http://localhost:3100/health

Claude OAuth Token — Step-by-Step

Step 1 — SSH onto the Talon VM

Connect to the VM that SOCFortress provisioned for you. The Talon application is installed at /opt/talon.

Step 2 — Navigate to the Talon directory

cd /opt/talon

Step 3 — Generate the OAuth token

Run the following command. You will be prompted to log in to your Claude account in a browser. Once authenticated, the token will be printed to your terminal.

# Log into your account 
claude 

# Then generate setup-token
​​​​​​​claude setup-token

The output will look like:

Your Claude OAuth token:

 sk-ant-oat01-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Copy this token and add it to your .env file.

Copy the full token — you will need it in the next step.

Step 4 — Add the token to /opt/talon/.env

Open the .env file with any editor:

nano /opt/talon/.env

Find the line that reads CLAUDE_CODE_OAUTH_TOKEN=YOUR_TOKEN_HERE and replace the placeholder with your token:

CLAUDE_CODE_OAUTH_TOKEN=sk-ant-oat01-XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

# Optional: webhook endpoint for the 15-minute SOC alert digest
# WEBHOOK_URL=https://your-endpoint.example.com/talon-digest
# WEBHOOK_SECRET=optional-bearer-token

# Required: API key for all HTTP channel requests (except /health)
HTTP_API_KEY=

# Optional: restrict the credential proxy to loopback only (default: 0.0.0.0)
# CREDENTIAL_PROXY_HOST=127.0.0.1

Save and close the file (Ctrl+O, then Ctrl+X in nano).

Step 5 — Restart the Talon service

systemctl restart talon
systemctl status talon # confirm it is running

.env Reference

Verification

Once the service is restarted with a valid token, use these commands to confirm everything is working:

# Health check (no auth required)
curl http://localhost:3100/health

# Set your API key
export TALON_API_KEY="your-http-api-key"

# Test SIEM connectivity
curl -s -N -X POST http://localhost:3100/message \
 -H "Content-Type: application/json" \
 -H "x-api-key: $TALON_API_KEY" \
 -d '{"message": "Check cluster health", "sender": "test"}'

Troubleshooting