Command Reference

Commands

Use this reference to browse Beacon commands by hierarchy. Each command links to the consolidated guide section with examples, flags, and operational notes.

Install and upgrade

Install the Beacon CLI, check for released updates, and repair endpoint configuration after upgrades:

Install Beacon

Install Beacon with Homebrew or platform archives.

Upgrade Beacon

Check for updates and upgrade the Beacon CLI.

Manual CLI Installation

Install from platform archives or build Beacon from source.

beacon

Command syntax

beacon [command]

Top-level Agent Beacon CLI commands.

Command	Description
`beacon ci`	Run ephemeral AI runtime telemetry collection in CI.
`beacon cloud`	Configure provider-managed cloud agent telemetry setup helpers.
`beacon doctor`	Alias for `beacon endpoint doctor`.
`beacon endpoint`	Manage local endpoint telemetry, runtime logs, and integrations.
`beacon inventory`	Alias for `beacon endpoint inventory`.
`beacon mcp`	Expose local Beacon activity to MCP clients.
`beacon rules`	Manage and author Beacon threat-detection rules.
`beacon scan`	Run threat-detection rules over local endpoint telemetry.
`beacon status`	Alias for `beacon endpoint status`.
`beacon token-usage`	Report token usage and attribution from Beacon runtime logs.
`beacon version`	Display the installed Agent Beacon CLI version.

beacon version

Command syntax

beacon version [command]

Display the installed Beacon version or check for released updates.

Command	Description
`beacon version check`	Check whether a newer Beacon CLI release is available.

beacon scan

Command syntax

beacon scan [flags]

Run threat-detection rules over local endpoint telemetry without network access.

Page	Description
`beacon scan`	Scan the runtime JSONL log with active rules and report findings.
`Run local scans`	Choose logs, rules, sessions, and output formats.
`Use scan gates`	Fail automation when findings meet a severity threshold.

beacon rules

Command syntax

beacon rules [command]

Manage local threat-detection rules and author rule packs.

Command	Description
`beacon rules list`	List the active threat-detection rules.
`beacon rules add`	Install local rule files into the store.
`beacon rules remove`	Remove a rule from the store by id.
`beacon rules pull`	Fetch an explicit rule pack URL into the store.
`beacon rules lint`	Validate rule files and run embedded conformance fixtures.
`beacon rules fields`	Print event fields available to rule CEL expressions.

beacon ci

Command syntax

beacon ci [command]

Run ephemeral Beacon telemetry collection for CI jobs without installing a persistent endpoint service.

Command	Description
`beacon ci exec`	Run a command with agent telemetry captured for CI.
`beacon ci start`	Start a detached telemetry session for later CI steps.
`beacon ci finish`	Stop, validate, and export a detached telemetry session.
`beacon ci validate`	Validate CI runtime telemetry artifacts.

beacon cloud

Command syntax

beacon cloud [command]

Configure provider-managed cloud agent telemetry setup helpers.

Command	Description
`beacon cloud claude-web print-setup`	Print a Claude Code cloud environment setup script.
`beacon cloud claude-web print-hooks`	Print Claude hook settings for a cloud sandbox.
`beacon cloud cursor print-setup`	Print a Cursor cloud agent binary setup script.
`beacon cloud cursor print-hooks`	Print Cursor project hook settings to commit for cloud agents.
`beacon cloud gcs setup`	Create or print GCS setup commands for cloud-agent telemetry.
`beacon cloud s3 setup`	Create or print S3 setup commands for cloud-agent telemetry.

beacon mcp

Command syntax

beacon mcp [command]

Expose local Beacon runtime activity through MCP.

Command	Description
`beacon mcp serve`	Run the local Beacon MCP server over stdio or loopback HTTP JSON-RPC.
`beacon mcp doctor`	Validate local Beacon MCP setup and print client configuration.

beacon endpoint

Command syntax

beacon endpoint [command]

Manage the local endpoint agent and inspect supported agent harness telemetry.

Command	Description
`beacon endpoint install`	Install or update the local endpoint collector, runtime telemetry configuration, and optional Splunk HEC or Falcon LogScale HEC forwarding.
`beacon endpoint status`	Inspect collector health, runtime log state, configured harnesses, diagnostics, forwarding readiness, and the Asymptote managed-ingest connection.
`beacon endpoint connect`	Approve this device in the Asymptote dashboard and start the Vector forwarder to managed ingest.
`beacon endpoint disconnect`	Stop the Asymptote forwarder and remove the local device key.
`beacon endpoint doctor`	Run local endpoint health checks with pass/fail exit behavior and optional safe remediation.
`beacon endpoint inventory`	Show configured, detected, hook, and observed endpoint inventory.
`beacon endpoint discover`	Discover supported local agent harnesses and their telemetry configuration state.
`beacon endpoint test-event`	Write a synthetic endpoint validation event to the runtime JSONL log.
`beacon endpoint bundle-diagnostics`	Write a redacted local diagnostics bundle for support and troubleshooting.
`beacon endpoint repair`	Repair Beacon endpoint service files, telemetry configuration, and optional collector forwarding destinations.
`beacon endpoint uninstall`	Remove Beacon endpoint service files, with an option to keep local logs.
`beacon endpoint update`	Check for, enable, or apply signed endpoint package updates.
`beacon endpoint config`	Inspect, validate, and update endpoint configuration.
`beacon endpoint onboarding`	Show, reset, or resend the one-time onboarding record.
`beacon endpoint dashboard`	Run the local dashboard over Beacon runtime logs for endpoint inspection.
`beacon endpoint wazuh`	Configure Wazuh ingestion for Beacon endpoint events.
`beacon endpoint elastic`	Generate Elastic content and run a local Elasticsearch, Kibana, and Filebeat validation stack.
`beacon endpoint datadog`	Generate Datadog Agent custom log collection content for Beacon endpoint events.
`beacon endpoint sumo`	Generate Sumo Logic HTTP Source forwarding content for Beacon endpoint events.
`beacon endpoint rapid7`	Generate Rapid7 InsightIDR Custom Logs forwarding content for Beacon endpoint events.
`beacon endpoint sentinel`	Generate Microsoft Sentinel Azure Monitor Agent forwarding content for Beacon endpoint events.
`beacon endpoint cloudwatch`	Generate AWS CloudWatch Logs forwarding content for Beacon endpoint events.
`beacon endpoint s3`	Generate AWS S3 forwarding content for Beacon endpoint events.
`beacon endpoint gcs`	Generate Google Cloud Storage forwarding content for Beacon endpoint events.
`beacon endpoint asymptote`	Generate the Vector forwarding pack for Asymptote managed ingest and write validation events.
`beacon endpoint hooks`	Manage supported hook-based endpoint telemetry.
`beacon endpoint fx`	Collect endpoint telemetry from fx session records on this machine.
`beacon endpoint integrations openclaw`	Set up and validate OpenClaw Gateway OTLP export.
`beacon endpoint integrations claude-cowork`	Set up and validate Claude Cowork OTLP export.

beacon endpoint config

Command syntax

beacon endpoint config [command]

Inspect, validate, and update endpoint configuration.

Command	Description
`beacon endpoint config show`	Print endpoint configuration with secrets redacted.
`beacon endpoint config validate`	Validate endpoint configuration and destination settings.

beacon endpoint wazuh

Command syntax

beacon endpoint wazuh [command]

Generate Wazuh configuration, content packs, and validation events for Beacon endpoint logs.

Command	Description
`beacon endpoint wazuh print-config`	Print a Wazuh `localfile` snippet for Beacon endpoint events.
`beacon endpoint wazuh install-pack`	Generate Beacon Wazuh rules, sample events, and config snippets into a directory.
`beacon endpoint wazuh validate`	Write and describe a known-good Beacon Wazuh validation event.

beacon endpoint elastic

Command syntax

beacon endpoint elastic [command]

Generate Elastic configuration, content packs, and local validation stacks for Beacon endpoint logs.

Command	Description
`beacon endpoint elastic print-config`	Print a Filebeat config for Beacon endpoint events.
`beacon endpoint elastic install-pack`	Generate Elasticsearch, Kibana, Filebeat, and Elastic Agent content into a directory.
`beacon endpoint elastic up`	Start a local Elasticsearch, Kibana, and Filebeat validation stack.
`beacon endpoint elastic down`	Stop the local Elastic validation stack.

beacon endpoint datadog

Command syntax

beacon endpoint datadog [command]

Generate Datadog Agent custom log collection content and validation events for Beacon endpoint logs.

Command	Description
`beacon endpoint datadog print-config`	Print a Datadog Agent custom log config for Beacon endpoint events.
`beacon endpoint datadog install-pack`	Generate Datadog Agent custom log integration content into a directory.
`beacon endpoint datadog validate`	Write and describe a known-good Beacon Datadog validation event.

beacon endpoint sumo

Command syntax

beacon endpoint sumo [command]

Generate Sumo Logic HTTP Source forwarding content and validation events for Beacon endpoint logs.

Command	Description
`beacon endpoint sumo print-config`	Print a Sumo HTTP Source smoke-test uploader for Beacon endpoint events.
`beacon endpoint sumo install-pack`	Generate Sumo Logic HTTP Source forwarding content into a directory.
`beacon endpoint sumo validate`	Write and describe a known-good Beacon Sumo Logic validation event.

beacon endpoint rapid7

Command syntax

beacon endpoint rapid7 [command]

Generate Rapid7 InsightIDR Custom Logs forwarding content and validation events for Beacon endpoint logs.

Command	Description
`beacon endpoint rapid7 print-config`	Print a Rapid7 Custom Logs webhook smoke-test uploader for Beacon endpoint events.
`beacon endpoint rapid7 install-pack`	Generate Rapid7 InsightIDR Custom Logs forwarding content into a directory.
`beacon endpoint rapid7 validate`	Write and describe a known-good Beacon Rapid7 validation event.

beacon endpoint sentinel

Command syntax

beacon endpoint sentinel [command]

Generate Microsoft Sentinel Azure Monitor Agent forwarding content and validation events for Beacon endpoint logs.

Command	Description
`beacon endpoint sentinel print-config`	Print a Sentinel DCR transform for Beacon endpoint events.
`beacon endpoint sentinel install-pack`	Generate Microsoft Sentinel forwarding content into a directory.
`beacon endpoint sentinel validate`	Write and describe a known-good Beacon Microsoft Sentinel validation event.

beacon endpoint cloudwatch

Command syntax

beacon endpoint cloudwatch [command]

Generate AWS CloudWatch Logs forwarding content and validation events for Beacon endpoint events.

Command	Description
`beacon endpoint cloudwatch print-config`	Print a Vector AWS CloudWatch Logs forwarding template for Beacon endpoint events.
`beacon endpoint cloudwatch install-pack`	Generate AWS CloudWatch Logs forwarding content into a directory.
`beacon endpoint cloudwatch validate`	Write and describe a known-good Beacon AWS CloudWatch Logs validation event.

beacon endpoint s3

Command syntax

beacon endpoint s3 [command]

Generate AWS S3 forwarding content and validation events for Beacon endpoint logs.

Command	Description
`beacon endpoint s3 print-config`	Print a Vector AWS S3 forwarding template for Beacon endpoint events.
`beacon endpoint s3 install-pack`	Generate AWS S3 forwarding content into a directory.
`beacon endpoint s3 validate`	Write and describe a known-good Beacon AWS S3 validation event.

beacon endpoint gcs

Command syntax

beacon endpoint gcs [command]

Generate Google Cloud Storage forwarding content and validation events for Beacon endpoint logs.

Command	Description
`beacon endpoint gcs print-config`	Print a Vector Google Cloud Storage forwarding template for Beacon endpoint events.
`beacon endpoint gcs install-pack`	Generate Google Cloud Storage forwarding content into a directory.
`beacon endpoint gcs validate`	Write and describe a known-good Beacon Google Cloud Storage validation event.

beacon endpoint asymptote

Command syntax

beacon endpoint asymptote [command]

Generate the Vector forwarding pack that sends Beacon endpoint events to Asymptote managed ingest, and write validation events.

Command	Description
`beacon endpoint asymptote print-config`	Print the Vector forwarding config for the configured runtime log.
`beacon endpoint asymptote install-pack`	Write the Asymptote forwarding pack to a directory.
`beacon endpoint asymptote validate`	Write and describe a known-good Beacon Asymptote validation event.

beacon endpoint hooks

Command syntax

beacon endpoint hooks [command]

Install, inspect, and remove hook-based telemetry for supported local runtimes.

Command	Description
`beacon endpoint hooks install`	Install Beacon endpoint hooks for supported hook harnesses.
`beacon endpoint hooks status`	Show Beacon endpoint hook integration status for a supported harness.
`beacon endpoint hooks uninstall`	Remove Beacon endpoint hooks for supported harnesses.

beacon endpoint integrations claude-cowork

Command syntax

beacon endpoint integrations claude-cowork [command]

Configure and validate Claude Cowork OpenTelemetry export.

Command	Description
`beacon endpoint integrations claude-cowork print-config`	Print Claude Cowork OTLP setup guidance for organization administrators.
`beacon endpoint integrations claude-cowork setup`	Print or create Claude Cowork OTLP admin settings.
`beacon endpoint integrations claude-cowork status`	Show Claude Cowork endpoint integration status.
`beacon endpoint integrations claude-cowork validate`	Validate whether Claude Cowork events are arriving at the configured collector.

beacon endpoint integrations openclaw

Command syntax

beacon endpoint integrations openclaw [command]

Configure and validate OpenClaw Gateway OpenTelemetry export.

Command	Description
`beacon endpoint integrations openclaw print-config`	Print OpenClaw Gateway OTLP setup guidance.
`beacon endpoint integrations openclaw status`	Show OpenClaw Gateway endpoint integration status.
`beacon endpoint integrations openclaw validate`	Validate whether OpenClaw OTLP-derived events are arriving.

Install and Upgrade

CLI Resources

Command Manual

Commands

Install and upgrade

Install Beacon

Upgrade Beacon

Manual CLI Installation

beacon

beacon version

beacon scan

beacon rules

beacon ci

beacon cloud

beacon mcp

beacon endpoint

beacon endpoint config

beacon endpoint wazuh

beacon endpoint elastic

beacon endpoint datadog

beacon endpoint sumo

beacon endpoint rapid7

beacon endpoint sentinel

beacon endpoint cloudwatch

beacon endpoint s3

beacon endpoint gcs

beacon endpoint asymptote

beacon endpoint hooks

beacon endpoint integrations claude-cowork

beacon endpoint integrations openclaw

​Commands

​Install and upgrade

Install Beacon

Upgrade Beacon

Manual CLI Installation

​beacon

​beacon version

​beacon scan

​beacon rules

​beacon ci

​beacon cloud

​beacon mcp

​beacon endpoint

​beacon endpoint config

​beacon endpoint wazuh

​beacon endpoint elastic

​beacon endpoint datadog

​beacon endpoint sumo

​beacon endpoint rapid7

​beacon endpoint sentinel

​beacon endpoint cloudwatch

​beacon endpoint s3

​beacon endpoint gcs

​beacon endpoint asymptote

​beacon endpoint hooks

​beacon endpoint integrations claude-cowork

​beacon endpoint integrations openclaw

Commands

Install and upgrade

beacon

beacon version

beacon scan

beacon rules

beacon ci

beacon cloud

beacon mcp

beacon endpoint

beacon endpoint config

beacon endpoint wazuh

beacon endpoint elastic

beacon endpoint datadog

beacon endpoint sumo

beacon endpoint rapid7

beacon endpoint sentinel

beacon endpoint cloudwatch

beacon endpoint s3

beacon endpoint gcs

beacon endpoint asymptote

beacon endpoint hooks

beacon endpoint integrations claude-cowork

beacon endpoint integrations openclaw