Beacon with Jamf and Microsoft Sentinel

brew trust asymptote-labs/tap
brew tap asymptote-labs/tap
brew install beacon
beacon endpoint install

beacon endpoint sentinel install-pack --system --output ./beacon-sentinel-pack

/opt/beacon/bin/beacon
/opt/beacon/bin/beacon-otelcol
/opt/beacon/bin/vector
/opt/beacon/jamf/claude/common/repair-hooks.sh
/opt/beacon/jamf/scripts/install-cursor-hooks.sh

#!/bin/bash
set -euo pipefail

DCE_ENDPOINT="${4:?parameter 4 is the Data Collection Endpoint URL}"
DCR_IMMUTABLE_ID="${5:?parameter 5 is the DCR immutable ID}"
AZURE_TENANT_ID="${6:?parameter 6 is the Entra tenant ID}"
AZURE_CLIENT_ID="${7:?parameter 7 is the Entra client ID}"
AZURE_CLIENT_SECRET="${8:?parameter 8 is the Entra client secret}"

LABEL="com.beacon.endpoint.sentinel-forwarder"
VECTOR_BIN="/opt/beacon/bin/vector"
BASE_DIR="/Library/Application Support/Beacon/Forwarders"
CONFIG_PATH="$BASE_DIR/sentinel-vector.toml"
ENV_PATH="$BASE_DIR/sentinel-vector.env"
WRAPPER="$BASE_DIR/run-sentinel-forwarder.sh"
LOG_DIR="/Library/Logs/Beacon"
PLIST_PATH="/Library/LaunchDaemons/$LABEL.plist"
DATA_DIR="/var/lib/vector/beacon-sentinel"

if [ ! -x "$VECTOR_BIN" ]; then
  echo "Vector not found at $VECTOR_BIN. Install the Beacon package first." >&2
  exit 1
fi

shell_quote() {
  printf "'%s'" "$(printf '%s' "$1" | sed "s/'/'\\\\''/g")"
}

mkdir -p "$BASE_DIR" "$LOG_DIR" "$DATA_DIR"
chmod 0755 "$BASE_DIR" "$LOG_DIR" "$DATA_DIR"

# This is vector.toml from `beacon endpoint sentinel install-pack --system`.
# Replace this block if a newer pack changes it.
cat >"$CONFIG_PATH" <<'EOF'
data_dir = "/var/lib/vector/beacon-sentinel"

[sources.beacon_runtime]
type = "file"
include = ["/var/log/beacon-agent/runtime.jsonl"]
read_from = "end"

[transforms.beacon_raw_record]
type = "remap"
inputs = ["beacon_runtime"]
source = '''
raw = string!(.message)
parsed, err = parse_json(raw)
ts = now()
if err == null && is_object(parsed) {
  ts = parse_timestamp(parsed.timestamp, format: "%+") ?? now()
}
. = {"RawData": raw}
.timestamp = ts
'''

[sinks.beacon_sentinel]
type = "azure_logs_ingestion"
inputs = ["beacon_raw_record"]
endpoint = "${BEACON_SENTINEL_DCE_ENDPOINT}"
dcr_immutable_id = "${BEACON_SENTINEL_DCR_IMMUTABLE_ID}"
stream_name = "Custom-BeaconRuntimeRaw"
timestamp_field = "TimeGenerated"

[sinks.beacon_sentinel.auth]
azure_credential_kind = "client_secret_credential"
azure_tenant_id = "${AZURE_TENANT_ID}"
azure_client_id = "${AZURE_CLIENT_ID}"
azure_client_secret = "${AZURE_CLIENT_SECRET}"

[sinks.beacon_sentinel.batch]
max_bytes = 524288
max_events = 1000
timeout_secs = 30

[sinks.beacon_sentinel.request]
retry_attempts = 10
retry_initial_backoff_secs = 1
retry_max_duration_secs = 300
EOF
chmod 0644 "$CONFIG_PATH"

{
  printf 'export BEACON_SENTINEL_DCE_ENDPOINT=%s\n' "$(shell_quote "$DCE_ENDPOINT")"
  printf 'export BEACON_SENTINEL_DCR_IMMUTABLE_ID=%s\n' "$(shell_quote "$DCR_IMMUTABLE_ID")"
  printf 'export AZURE_TENANT_ID=%s\n' "$(shell_quote "$AZURE_TENANT_ID")"
  printf 'export AZURE_CLIENT_ID=%s\n' "$(shell_quote "$AZURE_CLIENT_ID")"
  printf 'export AZURE_CLIENT_SECRET=%s\n' "$(shell_quote "$AZURE_CLIENT_SECRET")"
} >"$ENV_PATH"
chmod 0600 "$ENV_PATH"

cat >"$WRAPPER" <<'EOF'
#!/bin/sh
set -eu
ENV_PATH="/Library/Application Support/Beacon/Forwarders/sentinel-vector.env"
CONFIG_PATH="/Library/Application Support/Beacon/Forwarders/sentinel-vector.toml"
# shellcheck disable=SC1090
. "$ENV_PATH"
exec /opt/beacon/bin/vector --config "$CONFIG_PATH"
EOF
chmod 0755 "$WRAPPER"

cat >"$PLIST_PATH" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>$LABEL</string>
  <key>ProgramArguments</key>
  <array>
    <string>$WRAPPER</string>
  </array>
  <key>RunAtLoad</key>
  <true/>
  <key>KeepAlive</key>
  <true/>
  <key>StandardOutPath</key>
  <string>$LOG_DIR/$LABEL.out</string>
  <key>StandardErrorPath</key>
  <string>$LOG_DIR/$LABEL.err</string>
</dict>
</plist>
EOF
chmod 0644 "$PLIST_PATH"

# shellcheck disable=SC1090
. "$ENV_PATH"
"$VECTOR_BIN" validate --skip-healthchecks "$CONFIG_PATH"

target="system/$LABEL"
launchctl bootout "$target" >/dev/null 2>&1 || true
attempts=0
while launchctl print "$target" >/dev/null 2>&1; do
  attempts=$((attempts + 1))
  if [ "$attempts" -ge 65 ]; then
    echo "Timed out waiting for $LABEL to stop" >&2
    exit 1
  fi
  sleep 1
done
launchctl bootstrap system "$PLIST_PATH" >/dev/null 2>&1 || {
  echo "Could not bootstrap $LABEL" >&2
  exit 1
}
launchctl print "$target"

#!/bin/bash
set -euo pipefail
/opt/beacon/jamf/claude/common/repair-hooks.sh

#!/bin/bash
set -euo pipefail
/opt/beacon/jamf/scripts/install-cursor-hooks.sh

sudo /opt/beacon/bin/beacon endpoint status --system
/opt/beacon/bin/beacon endpoint hooks status --harness claude
/opt/beacon/bin/beacon endpoint hooks status --harness cursor
launchctl print system/com.beacon.endpoint.sentinel-forwarder

sudo /opt/beacon/bin/beacon endpoint sentinel validate --system

BeaconRuntime_CL
| where TimeGenerated > ago(1h)
| where Message has "Beacon endpoint Sentinel validation event"
| project TimeGenerated, HostName, UserName, HarnessName, EventAction, Message

BeaconRuntime_CL
| where TimeGenerated > ago(1h)
| where HarnessName in ("claude_code", "codex_cli", "cursor")
| summarize count() by HarnessName, EventAction, UserName