Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.asymptotelabs.ai/llms.txt

Use this file to discover all available pages before exploring further.

​
Retention and Redaction

Beacon content retention controls how much prompt, command, attribute, and diff content can be written to local JSONL and forwarded by customer-controlled pipelines. Choose the retention mode before rollout so endpoint events match your approved telemetry collection policy.

​
Retention Modes

ModeBehaviorUse when
metadataExcludes prompt text, raw attributes, command output, and raw diffsReviewers need activity metadata without retained content
redactedIncludes configured content fields after local redaction and size limitsReviewers need content context with secret-pattern reduction
fullIncludes configured content fields, still subject to event size limitsReviewers have approved full local or customer-controlled content capture
Configure retention during install or repair: 
beacon endpoint install --content-retention metadata
beacon endpoint repair --content-retention redacted

​
Metadata Example

With metadata, Beacon records event shape and operational context while omitting content fields such as prompt text, raw attributes, command output, and raw diffs. 
{
  "event": {
    "action": "prompt.submitted",
    "category": "prompt"
  },
  "harness": {
    "name": "cursor"
  },
  "session": {
    "id": "conversation-1",
    "working_directory": "/Users/local-user/repo"
  },
  "content": {
    "retention": "metadata",
    "included": false
  },
  "message": "Prompt submitted"
}

​
Redacted Example

With redacted, Beacon can include configured content fields after local redaction and size limits. Redaction is intended to reduce common secret patterns before the event is written. 
{
  "event": {
    "action": "prompt.submitted",
    "category": "prompt"
  },
  "harness": {
    "name": "claude"
  },
  "prompt": {
    "text": "Review this API client. Token: [REDACTED]"
  },
  "content": {
    "retention": "redacted",
    "included": true,
    "redacted": true
  }
}

​
Full Example

With full, Beacon can include configured content fields in local or customer-controlled logs, subject to event size limits and truncation markers. 
{
  "event": {
    "action": "command.executed",
    "category": "command"
  },
  "tool": {
    "name": "Shell",
    "command": "go test ./..."
  },
  "command": {
    "command": "go test ./...",
    "exit_code": 0,
    "duration_ms": 18420
  },
  "content": {
    "retention": "full",
    "included": true,
    "truncated": false
  }
}

​
Forwarding Implications

Retention is enforced before events are written to runtime.jsonl. File-based destinations such as Wazuh, Elastic/Filebeat, Datadog Agent custom log collection, Sumo Logic forwarding, Rapid7 forwarding, and customer-managed shippers read the resulting local JSONL. Splunk HEC and Falcon LogScale HEC forwarding receive the same normalized collector output according to the configured endpoint pipeline. Use metadata or redacted for stricter deployments. Use full only when prompt text, tool input, command output, and retained content match your approved telemetry policy.

Schema examples

Inspect full endpoint event examples and retention fields.

Endpoint install

Configure the content retention mode at install time.