talonctl

Infrastructure as code for CrowdStrike. Manage detections, workflows, saved searches, and more with a Terraform-like lifecycle.

What This Is

A pip-installable CLI tool for managing CrowdStrike NGSIEM resources as code. It started as the deployment engine behind an AI-assisted SOC project and works just as well standalone. If you use CrowdStrike NG-SIEM and want version-controlled, CI/CD-deployed resources -- this is it.

What you get:

• Terraform-like deployment -- plan/apply/import/drift/sync for CrowdStrike NGSIEM resources
• Seven resource types -- detections, saved searches, dashboards, workflows, lookup files, RTR scripts, RTR put files
• State management -- tracks deployed resources, content hashes, and CrowdStrike API IDs
• Dependency resolution -- DAG-based ordering so resources deploy in the right sequence
• Drift detection -- catch manual console changes that diverge from your templates
• Project scaffolding -- talonctl init creates new projects with the correct directory structure

Getting Started

# Install
python3 -m venv .venv
source .venv/bin/activate
pip install talonctl

# Scaffold a new project
talonctl init myproject
cd myproject

# Configure credentials
talonctl auth setup

# Import your existing detections
talonctl import --plan              # preview what would be imported
talonctl import --resources=detection  # import detection rules

# Plan and deploy
talonctl plan    # preview changes
talonctl apply   # deploy

For a working example project, see talonctl-demo.

Commands

IaC Lifecycle

talonctl validate                    # Check templates (no API calls)
talonctl plan                        # Preview changes
talonctl apply                       # Deploy changes
talonctl import                      # Onboard existing resources
talonctl import --plan               # Preview import
talonctl sync                        # Reconcile state with tenant
talonctl drift                       # Detect manual console changes
talonctl show                        # Display current state
talonctl find QUERY                  # Resolve UUID / resource_id / glob / composite ID
talonctl init                        # Scaffold a new project
talonctl validate-query              # Validate CQL syntax
talonctl publish                     # Activate inactive detection rules
talonctl discover                    # Find new detection templates

Credential Management

talonctl auth setup                  # Interactive credential setup wizard
talonctl auth check                  # Verify stored credentials

Operational

talonctl health                      # Detection health check
talonctl health --format json -o r.json  # Export health report
talonctl metrics update-detections --report r.json  # Update detection metrics CSV
talonctl metrics update-kpis --report r.json        # Update KPI CSV
talonctl backup create               # Create state backup (GitHub Release)
talonctl backup list                 # List available backups
talonctl backup restore <tag>        # Restore from backup

What It Manages

Prerequisites

• CrowdStrike Falcon tenant with NG-SIEM (LogScale)
• Python 3.11+
• CrowdStrike API credentials (Falcon Console > Support & Resources > API Clients and Keys)

Required API Scopes

By Resource Type

Minimum Scopes by Workflow

Ecosystem

talonctl was built alongside a set of AI-assisted security skills and a CrowdStrike MCP server. Together they form a detection engineering and SOC operations toolkit:

• talonctl-demo -- Working example project with saved searches, lookup files, knowledge base, and CI/CD workflows
• agent-skills -- Claude Code plugins for SOC triage, detection engineering, threat hunting, and more
• crowdstrike-mcp -- MCP server for querying alerts, running CQL, host lookup, and case management

Development

git clone https://github.com/willwebster5/talonctl.git
cd talonctl
python3 -m venv .venv
source .venv/bin/activate
pip install -e .[dev]
pytest tests/ -v

Format reference templates are in examples/resources/ -- annotated YAML examples for every resource type.

License

MIT -- do whatever you want, no warranty, no liability. See LICENSE.