Every link in the help grid above lands here. Use the browser's find (⌘F / Ctrl-F) to jump to a topic, or scroll through by section.
Getting Started
TALON platform overview
TALON MSP is a multi-tenant management portal that sits on top of Riverbed Aternity. It lets one operator (you, as an MSP) monitor digital experience, alerts, hardware health, software inventory, and license utilization across many end-customer Aternity tenants without bouncing between separate consoles.
The portal is structured around four ideas: an Active Client filter that scopes the whole UI to one customer at a time, a set of experience dashboards (DXI, UXI, ART, BOOT), a set of device and software dashboards (Device Health, Hardware, Unused Software, Smart Asset Refresh), and an AI layer that summarizes any view on demand. Multi-customer modules (Chargeback, ESG, Segmentation) sit on top of that base.
Everything you see here is read-only against Aternity — TALON never writes changes back. Configuration that affects TALON's behavior (thresholds, segmentation rules, AI provider keys) is stored locally to the portal.
You'll receive a TALON URL (e.g. https://rvbd.cloud) and either a local username/password or an Azure SSO invitation. If your organization uses SSO, just click the provider button on the login page — there's no separate password.
On first sign-in TALON drops you on the Quick Links page. From there, open the Auth Settings page from the sidebar and connect your Aternity credentials before anything else — most dashboards are empty until that's done. See Configuring the Aternity Connector.
From the sidebar's user menu, choose Account Security. The same page lets you rotate your password, enable two-factor authentication, and review recent sign-in activity for your account.
Local password rotation is independent of SSO — if your organization is SSO-only, the local-password section is hidden and your provider's password reset is the authoritative path.
TALON supports native RFC 6238 TOTP. From Account Security, click Enable 2FA. The page renders a QR code — scan it with any authenticator app (Microsoft Authenticator, Google Authenticator, 1Password, Authy) and enter the 6-digit code to confirm.
You'll be shown a one-time list of recovery codes — store them somewhere offline. They're the only way back in if you lose access to the authenticator. An admin can also issue a Revoke TOTP action from the User Admin page if both your authenticator and recovery codes are unrecoverable.
The dropdown at the top-left of the sidebar pins TALON to one customer at a time. Every dashboard, every drilldown, every AI summary scopes its data to that selection until you change it.
Choose All Clients to see aggregate views (useful on the executive Account View and the Smart Asset Refresh dashboard), or pick a single client to drill in. The selection is per-session — closing the browser tab resets it.
Open the Auth Settings page from the sidebar. Click + Add Connector, pick one or more Aternity regions (US2, US3, US5, EU, etc.), enter your Aternity REST API service-account credentials, and save. TALON immediately runs a test query against each selected region and reports OK / failure inline so you know the credentials work before you leave the page.
The credentials are encrypted at rest using a key sourced from your container's ATERNITY_CREDS_KEY environment variable. Once saved, you can also choose to switch the connector method from Basic to OAuth — see Aternity OAuth authentication setup.
OAuth uses Entra ID (Azure AD) client credentials instead of a username/password. On the Add Connector form choose OAuth (Entra ID), then provide the Entra tenant ID, client ID, client secret, and the OAuth scope your Aternity tenant exposes (typically api://<app-id>/.default).
OAuth is preferred for production because the bearer token rotates automatically and Aternity can lock individual basic-auth accounts during brute-force events. If you're an admin, you can set up an account-wide OAuth connector that applies to every user in your TALON tenant — see the Admin section of the same page.
Open SSO Integration from the Admin sidebar. Add a new provider (OIDC for Entra ID / Azure AD is most common), fill in the discovery URL, client ID, and client secret, and map the email domains your users sign in with. TALON multi-tenant support is built in — multiple Entra tenants can co-exist on the same TALON instance.
By default unknown tenants are auto-allowed on first sign-in. To require admin approval for new tenants, set SSO_AUTO_ALLOW_NEW_TENANTS=0 in the container environment.
TALON supports two ways of running multiple customer tenants. The first is a single TALON instance with multiple Aternity connectors — each connector points at a different customer's Aternity region, and the Active Client filter switches between them. This is the default and works for most MSPs serving up to a few dozen customers.
For larger MSP fleets or customers who require strict data isolation, TALON can run as one Container App per customer. Contact your RavenTek representative to discuss per-customer instance options.
One TALON instance, many Aternity clusters, many customers per cluster — all surfaced through one filter.
Quick Links is your editable landing page — a grid of tiles that link to the tools you use most. By default it ships with eight Riverbed / Aternity destinations (Highspot, the lab, Salesforce, SharePoint, the BOM tool, etc.).
To customize: click Edit Links in the page-hero actions, then use the per-tile arrows (move left / right), the pencil (edit title + URL + icon + color), the X (delete), or the dashed "Add Link" placeholder to add new tiles. Click Save to persist or Reset to Defaults to restore the built-in set.
URL validation rejects anything that isn't a fully-qualified https:// or http:// URL; titles and descriptions are HTML-stripped before storage so a hostile entry can't inject markup.
DXI (Device Experience Index) is a 0–100 weighted average of five Aternity-collected categories that measure how a device performs for its user. Higher is better; healthy is ≥85, watch is 75–85, problem is 60–75, at-risk is <60.
UXI (User Experience Index) is a 0–5 application-focused score combining crashes, hang time, wait time, and (for web apps) page errors and load time. Below 3.50 is critical, 3.50–3.80 is major, 3.80–4.20 is warning, above 4.20 is healthy.
Both are baseline-independent so they're directly comparable across customers. Account View, Current Alerts, and the cross-customer Dashboard Views all use them as the primary signal.
The DXI dashboard has three view modes selectable from the toolbar: Table (numeric, sortable by any column — best for sifting through many accounts), Chart (a per-account trend line — best for visualizing change over time), and Tile (color-banded cards — best for an at-a-glance executive view of one or many accounts).
Your view choice persists across page reloads via the URL, so you can bookmark a specific layout.
The timeframe selector at the top of every experience page (DXI, UXI, ART, BOOT) controls how far back the query reaches. Last 21 days is the recommended default — Aternity computes DXI weekly, so 21 days gives you three data points (last week, two weeks ago, three weeks ago) for trend.
Use 7 days for incident triage, 14 days to compare last week to the week before, 30+ days for long-term reporting and Smart Asset Refresh inputs.
ART measures end-to-end activity response time and splits it into client time, network time, and backend time. The ART page surfaces accounts whose average response time crossed a threshold from one period to the next, plus per-application breakdowns.
BOOT is Aternity's proprietary device-boot measurement (machine boot + user logon), expressed as both raw seconds and a percentile against the rest of the org. The BOOT page is most useful for identifying accounts where slow logons are dragging the DXI down.
Every account row carries a small Aternity ↗ link in its name column. Clicking it opens Aternity's executive dashboard for that account in a new tab, pre-filtered to the account ID. The exact destination depends on the account's home cluster — TALON resolves the correct host (e.g. https://rvbd.us5.aternity.com) from the connector configuration.
TALON runs a background worker every minute. For each account you can see, it pulls fresh Aternity data and evaluates a fixed rule set covering DXI drops, UXI low values, critical health-event spikes, license utilization, license expiration, and (when relevant) zero logins. Anything that crosses a threshold becomes an alert.
Alerts are de-duplicated by account + alert type — escalating a warning to critical updates the existing row instead of creating a second one, so the alerts list stays clean.
The Current Alerts page lists active alerts across every account you have visibility to. Each row shows account, severity (critical / major / warning), alert type, the metric value that triggered it, the delta from the previous reading, and an AI "Tell Me Why" button for one-click context.
Use the filter row to narrow by severity, alert type, or account. Click a row to see the full account snapshot at the moment the alert fired.
From Account Security → Alert Thresholds, you can override the built-in defaults per metric and per severity. Examples: lower the warning floor for UXI from 4.20 to 4.00 if your customer base runs hotter, or raise the DXI drop threshold from 3 points to 5 points to reduce noise.
Thresholds are per-user — your settings don't affect anyone else's alert feed. Click Reset to Defaults at any time to undo a customization.
Every alert row carries a Tell Me Why button. Clicking it sends the alert's metric snapshot to your configured AI provider (Gemini by default, OpenAI as fallback) and renders a short, human-readable explanation: what changed, what likely caused it, and what to investigate next.
Sensitive identifiers (usernames, full device names, IPs) are stripped before the prompt is sent — see PII sanitization. Responses are cached for 2 hours per (account, alert type) so a busy alerts page doesn't burn tokens on the same alert twice.
The Account View Executive page is the single-account dashboard. The top half is six KPI tiles — DXI, UXI, ART, BOOT, license utilization, and incidents — each colored against thresholds. The bottom half is a tabbed deeper drill: trend, accounts rail, alerts, AI summary.
Hide or show each tile and tab from the page's filter card. Settings persist via URL so you can save your preferred layout as a bookmark.
Inside Account View each KPI tile displays the current value plus the delta versus the prior period. The Reporting Agents tile shows how many Aternity-enrolled devices reported data in the period — a sudden drop typically signals an agent rollout or a network issue rather than a real performance change.
The Incidents tab pulls open Aternity incidents for the selected account, grouped by severity. Each row links into the same view in Aternity for the full kill-chain. The "Anomalies" sub-tab adds TALON-detected anomalies that Aternity didn't flag on its own (large period-over-period changes outside of an active incident).
The license tile shows current seats-in-use against the licensed seat count, plus the date of the next expiration. Warning bands: amber when utilization > 80%, red when > 95% or when an expiration is within 30 days.
The TALON Insights tab generates a one-paragraph executive summary of the account's current state: where it sits on each KPI, which directions things have moved, and the two or three things worth raising with the customer. Summaries are produced on demand and cached for 2 hours per account.
The cross-customer Incidents page lists every open Aternity incident across every account you can see. It's the right view to start a triage shift on. Columns: account, severity, type, affected user / device count, first detected, last updated.
Filtering incidents by account, severity, and type
Filter selectors at the top of the page narrow the list. Combine them: e.g. all critical incidents on the Network category to scope a network-team queue, or all major incidents for a single customer when reviewing during a steering call.
Clicking an incident row expands the inline panel with affected users, affected devices, the first event timestamp, and the incident's current Aternity classification. Use the Go to Aternity ↗ button to open the full incident timeline in Aternity for remediation.
Every incident row carries an Aternity drill link. TALON resolves the right Aternity cluster URL from your connector configuration so the link opens to the correct regional Aternity instance with the incident pre-selected.
The Device Health page surfaces individual devices ranked by current health, with the most-impacted at the top. Columns include device name, user, OS, last seen, and Aternity's health score broken out by critical / major / minor event counts.
Use the Active Client filter to scope to one customer's fleet, or run the page across all clients to find your most-troubled devices across the entire MSP book.
Combine the Active Client dropdown with the health-status selector and the in-table search to drill in: e.g. show only customer X's devices with at least one critical event last 7 days, or all devices org-wide whose health bucket just changed from "good" to "fair".
Each row shows current health-event totals broken into critical (BSODs, hard hangs), major (application crashes, severe slowdowns), and minor (transient warnings). The delta column shows whether each bucket grew or shrank versus the prior comparison window — that's usually a stronger signal than the absolute count.
System Crash Analyzer drills the device-health critical events into actionable groupings: a trend chart over time, top BSOD stop codes, top affected models, top affected processes, and a per-device table.
Click any point on the trend chart to filter the page to that day — counts in the rows update to reflect just that day's crashes.
Each BSOD reason and each device row carries a TALON Insights button. Clicking it sends the stop code, faulting component, OS version, and (where available) the stack trace to your AI provider and renders a likely root cause plus recommended Microsoft KB articles and driver-update paths.
Sensitive identifiers are stripped before the prompt is sent — see PII sanitization.
The Active Client filter at the top scopes by customer. The timeframe selector scopes by date range. The in-row search and the per-column sort headers let you slice further (e.g. only DLL crashes, only models in a specific OS family).
Hardware Inventory Age bucketizes the customer's device fleet by manufacturer, model, and device age. The top of the page is a model-distribution chart; below that is a sortable table with age, refresh disposition, and per-row drill into the device.
Identifying aging devices across your customer base
Sort by Age (yrs) descending to find the oldest devices. The disposition column flags Replace Now, Reallocate, Operate at Risk, and Compliant based on age plus performance score. Use this view to build refresh quotes during a quarterly business review.
For a more sophisticated refresh model, see Smart Asset Refresh, which blends age with persona tiers (T1–T5) and live performance data.
The Export CSV button at the top of the table downloads the current filtered view (manufacturer, model, age, disposition, last seen, location, user) as a CSV suitable for opening in Excel or feeding into a vendor portal for refresh ordering.
App Resource Usage pulls Aternity's APPLICATIONS_DAILY entity and aggregates CPU + memory consumption per application across the selected customer's fleet. The page lets you spot which apps are eating your endpoints — useful when building rationalization plans.
The main table shows average CPU %, peak CPU %, average memory MB, and peak memory MB per application. Sort by any column to find the worst offenders, then click into an app to see the per-version and per-device breakdown.
Use the version filter to identify version-fragmentation — multiple versions of the same app shipping on different devices typically points at an update-management gap.
Script Signer lets an admin sign PowerShell or shell scripts with the RavenTek code-signing certificate before distributing them to customer endpoints. Paste the script, hit Sign, and download the signed bundle. The companion helper for execution on the endpoint is part of the same admin section.
The Dashboard page is the cross-customer rollup — every account you can see, on one page, with DXI, UXI, ART, BOOT, license utilization, and an incident-count column. It's the right place to start a daily standup.
Use the search box to narrow to a subset of accounts, the timeframe selector to pick a comparison window (7 / 14 / 21 / 30 days), and the per-column sort headers to rank by whichever KPI matters most for the meeting you're prepping.
The Export CSV button captures the current filter + sort state. Useful when you want to drop the cross-customer rollup into an executive deck or share it with someone who doesn't have a TALON login.
Change Audit surfaces the volume of system-level changes on the customer's endpoint fleet — driver updates, OS patch installs, registry changes, and configuration changes — over the selected timeframe. High change volumes often correlate with the next period's incident spike.
The Software Updates sub-view filters Change Audit to just install / uninstall events, grouped by application. Use it to validate that a planned rollout reached the targeted devices, or to spot shadow-IT installs.
Active Client + timeframe + change-type filters combine the way you'd expect. Clicking any row opens an inline drill into the per-device change list for the same window.
The Last Logins page shows the most recent sign-in per Aternity user, scoped by Active Client. Use it to spot stale accounts (no login in 90+ days) that may be eligible for de-provisioning.
The License page rolls up seats-in-use, licensed seat count, utilization percent, and next-expiration date per account. Color bands highlight accounts approaching their seat cap or their license expiry.
The UA Adoption page tracks Aternity Unified Agent rollout progress per account — how many devices have the agent installed versus the estimated total endpoint count. Useful during onboarding when you're proving out telemetry coverage.
The Software Cost overview rolls up estimated annual license spend across every monitored application, with installed-seat counts, active-seat counts (used in the trailing 90 days), and a derived unused count that is the reclamation pipeline.
The default unit cost comes from Aternity's industry benchmarks; you can override it per application from the same page.
The Unused Software page drills the overview into per-account, per-application detail — every device where the application is installed but hasn't been actively used in the last 90 days. Two filters keep the noise down:
Hide freeware / viewer / trial — strips Adobe Reader, free utilities, and trial installs from the savings math.
Hide web-only rows — strips devices that only have web-session activity (no INSTALLED_SOFTWARE match), which Aternity's session-tracking tends to inflate.
The bottom of the Unused Software page totals the candidate-for-reclamation seat count times the per-seat cost, giving you a single annual-savings number to present to the customer. The CSV export pairs that with the device-by-device list so license admins can act on it.
Smart Asset Refresh classifies every device in the customer's fleet into a refresh disposition: Replace Now, Reallocate, Operate at Risk, Compliant, No Telemetry, or Excluded. The classifier combines device age, hardware spec, persona tier (T1–T5), and live performance score from Aternity.
The page is driven by a persona × age × spec matrix called the Spec Floors, editable per user from the floors-card panel. T1 (leadership) devices have the strictest minimums and the lowest max age; T5 (front-line) have the most permissive. Devices that fall below their persona's floor on CPU generation, RAM, storage, or age are flagged for replacement.
Performance and health scores override the matrix: a device that's young but performs poorly is still flagged.
Device Refresh is the simpler companion to Smart Asset Refresh: a per-device list driven by Aternity's enrollment date and OS support timeline, without the persona matrix. Use it when the customer wants a straight age-based refresh quote.
The Export CSV button on either Smart Asset Refresh or Device Refresh downloads the per-device list with disposition, recommended cascade destination, and classification rule. The CSV is the standard input to a customer-facing refresh-planning deck.
The MSP Module Suite is a family of features built specifically for managed service providers — operations that mostly don't exist in stock Aternity but that MSPs ask for repeatedly. The current suite includes Fleet Segmentation, Chargeback / Showback, and ESG / Green-IT. Each module reads its inputs from Aternity's existing entities and adds operator-editable configuration on top.
The modules share a tagging foundation: once you've segmented devices in Fleet Segmentation, the same tags drive Chargeback allocation and ESG reporting without re-entry.
Fleet Segmentation — tagging devices by business unit / persona New
Fleet Segmentation (admin page admin_segments.php) lets you tag each device with up to four attributes: business unit, cost center, persona, and VIP status. Tagging rules can match by device, by user, or by department, and can be scoped to one account or applied across all.
The fastest way to populate tags is the Import Departments action, which pulls every distinct USER_DEPARTMENT value from Aternity for the active customer and lets you map departments to business units in one form.
Chargeback / Showback — allocating cost per business unit New
Chargeback uses the Fleet Segmentation tags to allocate monthly device cost across business units, cost centers, or personas. Rates are configurable: a per-license rate, a per-device service rate, and an optional flat per-device rate. Admins can persist defaults; anyone can override per-session for a what-if quote.
Devices with no segmentation tag land in an "Unassigned" bucket so missing tags surface visibly rather than silently skewing the chart.
ESG / Green-IT — endpoint energy and carbon estimates New
ESG / Green-IT estimates annual electricity consumption (kWh) and carbon emissions (kg CO₂e) for the customer's endpoint fleet. The model: device count × per-device-type kWh profile × grid carbon factor. Defaults: 175 kWh/year for desktops, 50 kWh/year for laptops, 120 kWh/year for "other," with a 0.40 kg CO₂e/kWh grid factor.
All factors are admin-editable to match your customer's region. Results are allocated by Fleet Segmentation dimension so the chart aligns with chargeback.
Query Builder exposes Aternity's OData API through a guided UI. Pick an entity (DEVICE_INVENTORY, APPLICATIONS_DAILY, USER_AUDIT, etc.), pick fields, add filters, set ordering and a row limit, and run. Results render as a sortable table plus the built OData URL you can paste elsewhere.
Use Select All to add every field for an entity, then Clear All + tick individual ones once you know what you're after. Filters use Aternity's standard OData operators (eq, ne, gt, contains, startswith, etc.); combine multiple filters with AND or OR.
Save Query persists your query under a name for re-use. Saved queries are per-user; an admin doesn't need to re-create them for their team.
After a query runs, Export CSV downloads the result set, or Run TALON Insights sends the result to your AI provider for a one-paragraph summary. The PDF export bundles the table + AI summary into a customer-deliverable.
Network Model takes Aternity's per-app network-time measurements and overlays them with location and RTT baselines to suggest where bandwidth or routing changes would have the largest experience impact. Still alpha — useful directionally, not yet for capacity planning.
For each (app × location) pair, Network Model computes a baseline RTT from a rolling window and flags pairs whose recent RTT has drifted beyond the threshold. The recommendation column suggests a bandwidth increase, an SD-WAN route change, or further investigation depending on the deviation pattern.
SaaS Platform Status aggregates Aternity's monitoring of common SaaS endpoints (Microsoft 365, Salesforce, Workday, etc.) so you can see whether a customer-reported slowness is the SaaS provider's issue or the endpoint's.
Each row is one monitored SaaS service with current status (up / degraded / down), current latency, and a trend line. Click a row to see the per-region breakdown — useful when a customer is reporting a problem that only one of their offices sees.
TALON's AI features (Tell Me Why, account summaries, crash root-cause, query summaries) call your own AI provider using your own API key — Bring Your Own License. There's no shared TALON-side AI service, so your prompts and responses never touch RavenTek's infrastructure.
If no AI provider is configured, every AI button falls back to a deterministic rule-based explanation drawn directly from the metric data. The fallback is functional but less narrative than a real model response.
Out of the box TALON supports Google Gemini, OpenAI, and (optionally) Perplexity. The API Integration page lets you configure all three; routing decides which one to call first per feature, falling through on error.
Default priority: Gemini first (lowest cost-per-token for the volumes TALON generates), OpenAI as fallback, deterministic rules as final fallback.
Open API Integration from the Admin sidebar. For each provider you want to enable, paste the API key, choose the model (defaults are recommended), and click Save Provider Settings. Use the Test button to confirm the key works before any feature relies on it.
Create an API key at aistudio.google.com and paste it into the Gemini row on API Integration. The default model is gemini-2.0-flash-lite — cheap, fast, and good enough for TALON's prompt shapes. If you upgrade to a heavier model later, change it on the same row.
Create an API key at platform.openai.com and paste it into the OpenAI row. Default model is gpt-4o-mini. OpenAI is the default fallback when Gemini errors out, so configuring both is recommended for production resilience.
PII sanitization — what gets hashed before AI calls
Before any prompt is sent, TALON's ai_sanitize_for_prompt() helper redacts 14 sensitive keys: usernames, full device names, IP addresses, email addresses, MAC addresses, serial numbers, and so on. Replacements are stable hashes — the AI can reason about "device A vs device B" without ever seeing real names.
Redaction is applied recursively, including inside nested structures. A redacted prompt is what's logged in the AI call audit, not the original.
Every AI call passes through sanitize → router → audit. No raw identifiers leave the TALON instance.
Identical (feature + account + payload-hash) AI calls share a cached response for 2 hours. A busy alerts page that fires the same Tell-Me-Why request a hundred times in the next hour will spend tokens once. The cache is per-TALON-instance, not per-user — your team shares the cache among themselves.
Cache busts: a code-side version stamp invalidates the cache when a prompt shape changes. You can also flush the cache manually from Admin → Clear Cache.
The API Integration page surfaces a per-call log with input + output token counts and an estimated cost using the provider's published rate card. Use it after a busy week to calibrate which features are worth the spend (e.g. crash root-cause tends to be the most expensive because the stack trace is long; alert summaries are cheap).
Deterministic fallback when no AI key is configured
Every AI feature has a non-AI fallback that produces a structured explanation from the metric data directly: which thresholds were crossed, by how much, and what the metric definitions say about likely cause. Fallback responses are obviously less natural than a real model response, but they're always available and always free.
Admin-only. From User Admin in the sidebar, you can create new local users, set or revoke admin status, reset passwords, revoke a user's TOTP enrollment, clear API credential locks, delete API credentials, and delete users permanently. Each action prompts a confirm and is written to the audit log.
TALON has two roles: standard (read access to dashboards, can manage their own Aternity credentials and AI keys, can see their own data) and admin (everything in standard plus User Admin, API Integration, SSO Integration, Audit Log, account-wide OAuth connectors, the MSP-module rate / factor defaults).
Standard users can be granted to-admin via User Admin → Make admin. Removing admin uses the same row's Remove admin.
On the User Admin page, click Reset password on the user's row. The user's current password is invalidated immediately; you'll be prompted to share the temporary password securely with them, and they'll be required to set a new one on next login.
For SSO-only users, this action is unnecessary — they should reset via their identity provider.
API Integration — configuring external API access Admin
API Integration centralizes the configuration for the AI providers (Gemini, OpenAI, Perplexity), the routing priority order, and the call log. Three tabs: Providers, Routing, Call Log.
Provider settings are stored locally on the TALON instance, encrypted at rest. The Clear Log button on the Call Log tab wipes the per-call audit (the provider settings themselves aren't affected).
See Configuring SSO / Azure AD integration for a full walkthrough. The SSO Integration page also exposes per-provider domain mappings, the global "allow local password fallback" toggle, the JIT-provisioning toggle, and the default-redirect-after-sign-in setting.
Email Configuration — Microsoft Graph mail setup Admin
TALON sends report emails via Microsoft Graph (not SMTP). On the Graph Mail admin page you'll see the four environment variables you need to set: GRAPH_TENANT_ID, GRAPH_CLIENT_ID, GRAPH_CLIENT_SECRET, and GRAPH_MAIL_FROM.
The page walks you through creating an Entra app registration and granting the Mail.Send application permission. Click Test connection once the variables are set to verify the access-token flow.
Once Graph Mail is configured, the per-page Email Report button on Account View, Smart Asset Refresh, and the Dashboard sends the current view (with AI summary if available) as a styled HTML email to the addresses you specify.
The Audit Log page lists every privileged action across the TALON instance: user-admin operations, SSO config changes, AI provider edits, MSP-module rate updates, and Smart Asset Refresh floor saves. Filter by actor, action, or date range.
The Export CSV button on the Audit Log downloads the current filter as a CSV — useful for compliance evidence (SOC 2, ISO 27001, etc.) or for periodic out-of-band review.
Users can submit a bug or enhancement request from the floating widget at the bottom-right of every page. Admin sees all submissions on the Bug Reports page with the submitter, the page they were on, the OS / browser, and the message body. Submissions that contain attachments include a thumbnail preview.
If GitHub integration is configured, the page can sync each submission to a GitHub issue with one click.
See Setting up two-factor authentication. Note that if your TALON instance is configured to require 2FA for all users, you'll be prompted to enroll on first login rather than having the option to skip.
Use the moon / sun icon in the sidebar to toggle. Your preference is stored in a long-lived cookie and a localStorage key so it persists across tabs and reloads. Light mode is supported but dark is the default; pages with embedded SVGs use a separate logo asset for each theme to maintain contrast.
If your password is being rejected, check that Caps Lock isn't on and that you haven't accidentally pasted an extra space. After 5 consecutive failures the account is locked for 15 minutes; an admin can clear the lock from the User Admin page.
If your organization uses SSO, the local-password field is hidden — sign in via the provider button. If you don't see a provider button, your email domain may not be mapped on the SSO Integration page yet; ask your TALON admin to add it.
Usually one of three things: (1) the SSO provider's redirect URI doesn't match what TALON expects (should be https://<your-talon-host>/auth/sso/callback.php?provider=<slug>), (2) your Entra tenant isn't on the allowed list (check SSO_AUTO_ALLOW_NEW_TENANTS), or (3) your email domain isn't mapped to the provider on SSO Integration.
Browser cookies that are too old can also cause a loop — close all TALON tabs, clear cookies for the TALON domain, then retry.
TOTP relies on accurate device time. If your phone's clock is more than ~30 seconds out of sync with TALON's server time, codes won't match. Enable automatic time on your phone (most operating systems use NTP), then retry.
If you've genuinely lost both the authenticator app and your recovery codes, an admin can revoke TOTP for you from User Admin and you'll re-enroll on next login.
Open Auth Settings and look at your saved connector. If it shows "never tested" or "error", click Test and read the inline message. The most common failures: 401 (wrong username or password), 403 (account doesn't have the REST API role on this region), and 404/timeout (network egress is blocked).
Once the test is green, give the alert worker a minute to refresh — most dashboards re-pull on next visit but the alerts feed runs on a cron tick.
TALON caches Aternity responses for 5–15 minutes depending on the entity (longer for slow-changing things like account directory, shorter for hot tables like USER_AUDIT). Force a refresh by clicking the ↺ Refresh Data button on the page where you're seeing stale data — that bypasses the cache for one request.
If a page has no refresh button, you can usually force-reload by appending ?nocache=1 to the URL.
The Active Client dropdown is built from your saved connector. If a customer is missing, either (a) the connector doesn't include that account's region, or (b) your service account doesn't have role-based access to that account in Aternity. Test the connector for the missing region in Auth Settings to confirm which.
Admins can also configure per-user account scope on the User Scope admin page — if that's enabled, your account list is filtered to the explicit allow-list set by your admin.
Check the AI Call Log on the API Integration page for the most recent attempt. The most common causes: provider API key has been rotated and not updated in TALON, the configured model has been retired by the provider, or the daily quota for your provider has been exhausted. The log will show the upstream HTTP code and error message.
Errors like 401 / 403 from the provider almost always mean a bad key. Test the provider from the API Integration page using the Test button — that runs a minimal call and surfaces the upstream error verbatim. If the test passes but real calls still fail, you may be hitting a per-model permission (some keys can call gpt-4o-mini but not gpt-4o); double-check the model dropdown.
Review the AI Call Log and sort by input-tokens descending. The usual suspects are query-builder summary calls on very large result sets and crash-analysis calls on devices with deep stack traces. Truncate large result sets before sending or skip the AI summary for those rows.
The 2-hour cache should be cutting your bill substantially — if it's not, check that the cache hasn't been cleared recently from Admin → Clear Cache.
From the Graph Mail admin page, click Test connection. If it fails, the message tells you whether the issue is acquiring an access token (credential / permissions problem) or the actual send (Graph API permission problem). Most production failures are missing Mail.Send permission on the app registration, or admin consent that was never granted.
The four required environment variables are GRAPH_TENANT_ID, GRAPH_CLIENT_ID, GRAPH_CLIENT_SECRET, and GRAPH_MAIL_FROM. The most common cause of an authentication failure is a rotated client secret that hasn't been updated in TALON — Entra secrets typically expire every 6, 12, or 24 months by policy. The status panel on the Graph Mail page shows whether each variable is set.
Open a ticket with the ManagedDEX customer support team, email RavenTek support, or submit feedback directly from within the TALON portal using the bug report widget.