Skip to main content

​
beacon endpoint sentinel

Use beacon endpoint sentinel to generate Microsoft Sentinel forwarding content for Beacon endpoint events. The generated pack keeps Beacon as a local JSONL producer and helps Azure Monitor Agent tail runtime.jsonl into a Log Analytics custom table through a Data Collection Rule. Beacon does not store Azure tenant IDs, client secrets, workspace IDs, DCR identifiers, ingestion endpoints, or Azure Monitor Agent configuration. Keep those values in Azure, endpoint-management policy, or deployment tooling. 
beacon endpoint sentinel [command]

​
Commands

beacon endpoint sentinel print-config

Print the Sentinel DCR transform for Beacon endpoint events.

beacon endpoint sentinel install-pack

Write Microsoft Sentinel forwarding content to a directory.

beacon endpoint sentinel validate

Write and describe a Beacon Microsoft Sentinel validation event.

​
Runtime log paths

ModePath
User mode~/.beacon/endpoint/logs/runtime.jsonl
System mode/var/log/beacon-agent/runtime.jsonl

​
beacon endpoint sentinel print-config

beacon endpoint sentinel print-config prints the KQL transform used by the Microsoft Sentinel Data Collection Rule. The output starts with the Azure Monitor Agent file pattern selected from the active Beacon runtime log path. 
beacon endpoint sentinel print-config
Use this command when you want to inspect or copy the transform into an existing DCR workflow.

​
Examples

Print the DCR transform for the default per-user Beacon install: 
beacon endpoint sentinel print-config
Print the DCR transform for a system-mode MDM deployment: 
sudo /opt/beacon/bin/beacon endpoint sentinel print-config --system
Print the DCR transform for a custom runtime log: 
beacon endpoint sentinel print-config --log-path /path/to/runtime.jsonl

​
Flags

FlagDescription
--userUse per-user endpoint paths. Enabled by default
--systemUse system endpoint paths and launch daemon
--log-path <path>Runtime JSONL log path

​
beacon endpoint sentinel install-pack

beacon endpoint sentinel install-pack writes Microsoft Sentinel forwarding content to a directory. 
beacon endpoint sentinel install-pack --output ./beacon-sentinel-pack
The pack includes setup instructions, the BeaconRuntime_CL table schema, a DCR template, the DCR transform, starter hunting queries, example detection logic, and sample Beacon endpoint events.

​
Examples

Generate a content pack for the default per-user install: 
beacon endpoint sentinel install-pack --output ./beacon-sentinel-pack
Generate a content pack for a system-mode deployment: 
sudo /opt/beacon/bin/beacon endpoint sentinel install-pack \
  --system \
  --output ./beacon-sentinel-pack
Generate a content pack for a custom runtime log: 
beacon endpoint sentinel install-pack \
  --output ./beacon-sentinel-pack \
  --log-path /path/to/runtime.jsonl

​
Flags

FlagDescription
--output <dir>Output directory for the Microsoft Sentinel content pack. Defaults to beacon-sentinel-pack
--userUse per-user endpoint paths. Enabled by default
--systemUse system endpoint paths and launch daemon
--log-path <path>Runtime JSONL log path

​
beacon endpoint sentinel validate

beacon endpoint sentinel validate writes a Beacon validation event to the runtime JSONL log and prints the expected Microsoft Sentinel table and validation query. 
beacon endpoint sentinel validate

​
Examples

Write a validation event for the default per-user install: 
beacon endpoint sentinel validate
Write a validation event for a system-mode deployment: 
sudo /opt/beacon/bin/beacon endpoint sentinel validate --system
Write a validation event to a custom runtime log: 
beacon endpoint sentinel validate --log-path /path/to/runtime.jsonl
The validation command prints the expected Sentinel table and query: 
Expected Sentinel table: BeaconRuntime_CL
Expected validation query: BeaconRuntime_CL | where Message has "Beacon endpoint Sentinel validation event"

​
Flags

FlagDescription
--userUse per-user endpoint paths. Enabled by default
--systemUse system endpoint paths and launch daemon
--log-path <path>Runtime JSONL log path

Microsoft Sentinel forwarding

Configure Azure Monitor Agent and Data Collection Rules for Beacon events.

SIEM forwarding

Review forwarding patterns and validation steps.

Endpoint agent

Install and inspect the local endpoint agent.

Endpoint event schema

Review normalized Beacon JSONL fields and example events.