Documentation Index
Fetch the complete documentation index at: https://docs.asymptotelabs.ai/llms.txt
Use this file to discover all available pages before exploring further.
Schema Fields
Beacon models each endpoint event as an action plus a set of typed entities. Theevent object and surrounding entities describe what happened and who or what participated in that action.
Entity model
| Entity | Purpose | Common fields |
|---|---|---|
endpoint | Device and agent context for the machine where telemetry was collected | hostname, os, agent_version |
user | Local operating system user context | name, uid |
harness | AI runtime or integration that produced the signal | name, version, executable_path, config_path |
session | Conversation or runtime session context | id, working_directory |
tool | Tool invocation context, including shell-like tools | name, command, path |
file | File activity context | path, operation, language, diff_hash, diff_bytes |
command | Shell or process execution context | command, exit_code, duration_ms |
mcp | MCP-like server and tool context | server, tool |
approval | Approval or policy decision context | required, decision, reason |
policy | Policy metadata when available from a runtime or integration | id, name, decision, enforcement, reason |
prompt | Prompt text when content retention allows it | text |
content | Content-retention state for the event | retention, included, redacted, truncated |
destination | Output or validation destination state | type, mode, status |
health | Endpoint or component health state | component, status, reason |
model, repository, branch, message, raw, and field_truncated fields add shared context that can apply across multiple entities. For example, a command event can include both tool and command; a file edit can include file, session, repository, and branch; and a validation event can include destination.
Optional context
Optional context fields add detail when available:| Field | Detail |
|---|---|
user | Local user metadata |
session | Conversation or runtime session metadata |
tool | Tool name, command, or path metadata |
file | File path, operation, language, diff hash, or diff byte counts |
command | Shell command, exit code, or duration metadata |
mcp | MCP-like server and tool metadata |
approval | Approval requirement, decision, or reason |
policy | Policy ID, name, decision, enforcement mode, or reason |
content | Content retention mode and inclusion/redaction state |
destination | Output destination state, such as Wazuh localfile validation |
health | Component health status |
model, repository, branch, message, raw, field_truncated | Additional runtime context and truncation metadata |
Related
Endpoint event schema
Return to the schema overview.
Schema normalization
See how source fields map into the endpoint event contract.
Schema examples
Inspect an example command event and content-retention behavior.