Skip to main content

​
Command Overview

beacon rules list prints the active threat-detection rules used by beacon scan.
Command syntax
beacon rules list [flags]
The output includes each rule id, severity, maturity status, and source. The source shows whether Beacon loaded the rule from the local store or the built-in baseline.

​
Examples

List active user-mode rules:
List active rules
beacon rules list
List active system-mode rules:
List system-mode rules
sudo beacon rules list --system

​
Flags

FlagDescription
--userUse per-user endpoint paths. Enabled by default
--systemUse system endpoint paths

beacon rules add

Install local rule files into the store.

beacon scan

Run active rules over local telemetry.