> ## Documentation Index > Fetch the complete documentation index at: https://docs.asymptotelabs.ai/llms.txt > Use this file to discover all available pages before exploring further. # CrowdStrike Falcon LogScale > Forward Beacon endpoint telemetry to CrowdStrike Falcon LogScale with HTTP Event Collector. ## Forwarding Overview Beacon supports CrowdStrike Falcon HEC forwarding in two ways: * **Collector forwarding** sends OTLP events that pass through Beacon's local collector directly to Falcon. * **Vector runtime-log forwarding** tails Beacon's local `runtime.jsonl` file and forwards hook-written events to Falcon. Use Vector runtime-log forwarding when Claude Code telemetry is produced by Beacon hooks, or when your organization manages Claude's OTLP settings separately. Beacon still writes every normalized endpoint event to the active [runtime JSONL log](/concepts/core-concepts#runtime-jsonl-log). ## Runtime log paths | Mode | Runtime log | | ----------- | --------------------------------------- | | User mode | `~/.beacon/endpoint/logs/runtime.jsonl` | | System mode | `/var/log/beacon-agent/runtime.jsonl` | Use system mode for MDM deployments so every managed endpoint writes to `/var/log/beacon-agent/runtime.jsonl` while the collector forwards to Falcon LogScale. ## Falcon LogScale data connection Use CrowdStrike Falcon LogScale data onboarding to collect Beacon endpoint telemetry from local JSONL logs. Beacon writes one JSON object per line, so create a custom parser before creating the data connection. ### Open data onboarding In CrowdStrike Falcon, go to **Next-Gen SIEM** > **Log management** > **Data onboarding**. CrowdStrike Falcon navigation showing Next-Gen SIEM data onboarding under Log management. ### Select the Falcon LogScale Collector Search for `logscale`, select **Falcon LogScale Collector**, then choose **Configure**. CrowdStrike data connectors page filtered to the Falcon LogScale Collector connector. ### Create the Beacon parser In **Parsing and enrichment**, select **Create new parser**. Name the parser `beacon-jsonl`, choose **Blank template**, and create the parser. CrowdStrike create new parser dialog with parser name beacon-jsonl and blank template selected. Paste this parser script: ```text theme={null} /* # Beacon Endpoint Agent JSONL Parser Parses Beacon endpoint telemetry where each log line is one JSON object. */ | Vendor := "beacon" | Parser.version := "1.0.0" | ecs.version := "8.17.0" | Cps.version := "2.0.0" | event.module := "endpoint-agent" | observer.type := "endpoint" | parseJson(prefix="Vendor.", excludeEmpty="true", handleNull="discard") | Vendor.timestamp := Vendor.timestamp | parseTimestamp(field="Vendor.timestamp", format="yyyy-MM-dd'T'HH:mm:ss[.SSS]XXX", timezone="UTC") | event.kind := "event" | event.action := Vendor.event.action | event.module := Vendor.product | event.provider := Vendor.vendor | event.dataset := "beacon.endpoint-agent" | event.code := Vendor.schema_version | array:append(array="event.category[]", values=[Vendor.event.category]) | array:append(array="event.type[]", values=["info"]) | observer.vendor := Vendor.vendor | observer.product := Vendor.product | observer.version := Vendor.endpoint.agent_version | host.hostname := Vendor.endpoint.hostname | host.os.type := Vendor.endpoint.os | user.name := Vendor.user.name | user.id := Vendor.user.uid | process.command_line := Vendor.command.command | process.name := Vendor.tool.name | file.path := Vendor.file.path | file.hash.sha256 := Vendor.file.diff_hash | message := Vendor.message ``` Use this sample event as parser test data: ```json theme={null} {"timestamp":"2026-05-26T15:48:00Z","vendor":"beacon","product":"endpoint-agent","schema_version":"1.0","event":{"kind":"agent_runtime","action":"tool_use","category":"process"},"severity":"info","endpoint":{"hostname":"test-mac","os":"darwin","agent_version":"0.0.1"},"user":{"name":"justin","uid":"501"},"harness":{"name":"cursor"},"tool":{"name":"shell","command":"go test ./..."},"message":"Command executed"} ``` Run the parser test and confirm the parsed fields include `event.dataset`, `event.action`, `host.hostname`, `user.name`, `process.name`, and `message`. Events that include `command.command` also populate `process.command_line`. Save the parser when the sample event passes. CrowdStrike parser editor with the Beacon JSONL parser script and test data results. ### Create the data connection Return to the Falcon LogScale Collector connection details. Enter a connection name such as `Beacon Agent Logs`, add a description, select the `beacon-jsonl` parser, enable host enrichment if desired, accept the connector terms, and create the connection. CrowdStrike new connection details page with Beacon Agent Logs and the beacon-jsonl parser selected. After creating the connection, open the connection actions menu and select **Generate API key**. Save the generated API key with the connection API URL so your LogScale Collector can authenticate when forwarding Beacon events. CrowdStrike connection details page for Beacon Agent Logs showing the Generate API key action. ### Run a smoke test Run this local smoke test, replacing the token value with the API key generated for your data connection: ```bash title="Run the local smoke test" theme={null} export FALCON_HEC_TOKEN='PASTE_API_KEY_HERE' curl -sS -X POST 'https://7231610123af4402acf206f8f29d9fcd.ingest.us-2.crowdstrike.com/services/collector' \ -H "Authorization: Bearer ${FALCON_HEC_TOKEN}" \ -H 'Content-Type: application/json' \ -d '{"event":{"timestamp":"2026-05-26T16:02:00Z","vendor":"beacon","product":"endpoint-agent","schema_version":"1.0","event":{"kind":"agent_runtime","action":"tool_use","category":"process"},"severity":"info","endpoint":{"hostname":"test-mac","os":"darwin","agent_version":"0.0.1"},"user":{"name":"justin","uid":"501"},"harness":{"name":"cursor"},"tool":{"name":"shell","command":"crowdstrike ingest test"},"message":"Beacon CrowdStrike HEC smoke test"},"source":"beacon-endpoint-agent","sourcetype":"beacon-jsonl"}' ``` A working connection returns a success JSON response. Then search LogScale for the smoke-test message: ```text theme={null} "Beacon CrowdStrike HEC smoke test" ``` This is what the smoke-test event looks like in CrowdStrike: CrowdStrike Advanced event search showing a parsed Beacon endpoint smoke test event with normalized fields. ## Choose a forwarding path | Path | Use when | Notes | | ----------------------------- | ------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------- | | Collector forwarding | Claude, Codex, or another runtime sends OTLP to Beacon's local collector | Configure Falcon HEC on `beacon endpoint install` or `repair`. | | Vector runtime-log forwarding | Claude hook events are written directly to `runtime.jsonl` | Deploy the Beacon macOS package with Vector bundled, then run the Falcon Vector forwarder script. | ## Collector forwarding Pass Falcon HEC settings during endpoint install: ```bash title="Pass Falcon HEC settings during endpoint install" theme={null} sudo /opt/beacon/bin/beacon endpoint install \ --system \ --falcon-hec-endpoint https://cloud..humio.com/api/v1/ingest/hec \ --falcon-hec-token "$FALCON_HEC_TOKEN" \ --falcon-index beacon \ --falcon-source beacon-endpoint-agent ``` To add or update Falcon HEC on an existing endpoint, run repair with the same destination flags: ```bash title="Update Falcon HEC on an existing endpoint" theme={null} sudo /opt/beacon/bin/beacon endpoint repair \ --system \ --falcon-hec-endpoint https://cloud..humio.com/api/v1/ingest/hec \ --falcon-hec-token "$FALCON_HEC_TOKEN" \ --falcon-index beacon ``` ## Settings | Setting | Recommendation | | -------------------- | ----------------------------------------------------------------------------------------------------- | | Endpoint | Falcon LogScale HEC ingest endpoint URL | | Token | Falcon LogScale ingest token from your LogScale administrator | | Repository | Optional repository for multi-repository tokens, passed with `--falcon-index` | | Source | Optional source value. Defaults to `beacon-endpoint-agent` | | Parser or sourcetype | Optional parser or sourcetype value. Defaults to `json` | | TLS | Use normal certificate validation. Reserve `--falcon-insecure-skip-verify` for private test endpoints | If your Falcon LogScale endpoint uses a private CA, pass the CA bundle with `--falcon-ca-file /path/to/ca.pem`. ## Collector behavior When Falcon HEC is configured, Beacon writes a collector pipeline with both exporters enabled: ```text theme={null} exporters: [beaconjson, falcon_hec] ``` The `beaconjson` exporter preserves the local runtime log. The `falcon_hec` exporter sends Beacon-normalized OTLP logs, traces, and metrics to Falcon LogScale as newline-delimited HEC events. Each HEC payload wraps the normalized Beacon event object, includes an `@timestamp`, and uses the configured token, source, sourcetype, and repository. ## Vector runtime-log forwarding Beacon `v0.0.49` adds a managed Vector path for hook-only deployments. This is the recommended path when Claude Code hooks write events to `runtime.jsonl` but the Beacon collector is not the source of those events. The data flow is: ```text theme={null} Claude hooks -> runtime.jsonl -> Vector -> CrowdStrike Falcon HEC ``` ### Package requirement Use the Beacon macOS package that includes Vector. Homebrew updates the `beacon` CLI, but it does not install `/opt/beacon/bin/vector` or the Jamf helper scripts. The package installs: ```text theme={null} /opt/beacon/bin/vector /opt/beacon/jamf/claude/falcon/install-forwarder.sh /opt/beacon/jamf/claude/falcon/repair-hooks-and-forwarder.sh /opt/beacon/jamf/claude/falcon/run-forwarder.sh ``` These packaged helpers come from the repository paths: * [`packaging/macos/jamf/claude/falcon/install-forwarder.sh`](https://github.com/Asymptote-Labs/agent-beacon/blob/main/packaging/macos/jamf/claude/falcon/install-forwarder.sh) * [`packaging/macos/jamf/claude/falcon/repair-hooks-and-forwarder.sh`](https://github.com/Asymptote-Labs/agent-beacon/blob/main/packaging/macos/jamf/claude/falcon/repair-hooks-and-forwarder.sh) * [`packaging/macos/jamf/claude/falcon/run-forwarder.sh`](https://github.com/Asymptote-Labs/agent-beacon/blob/main/packaging/macos/jamf/claude/falcon/run-forwarder.sh) ### Manual setup without Jamf To simulate the Jamf setup on one Mac, install the Beacon package, then run the packaged helper manually. Jamf reserves script arguments 1-3, so pass `_ _ _` before the custom parameters: ```bash title="Simulate the Jamf setup on one Mac" theme={null} export FALCON_HEC_ENDPOINT="https://.ingest..crowdstrike.com/services/collector" export FALCON_HEC_TOKEN="PASTE_TOKEN_HERE" sudo /opt/beacon/jamf/claude/falcon/repair-hooks-and-forwarder.sh \ _ _ _ \ "$FALCON_HEC_ENDPOINT" \ "$FALCON_HEC_TOKEN" \ "beacon-endpoint-agent" \ "json" ``` The script: * prepares `/var/log/beacon-agent/runtime.jsonl`, * installs Claude Code hooks for the logged-in console user, * creates `/Library/Application Support/Beacon/Forwarders/falcon-vector.toml`, * stores the token in `/Library/Application Support/Beacon/Forwarders/falcon-vector.env`, * starts `com.beacon.endpoint.falcon-forwarder`. ### Jamf parameters Use `/opt/beacon/jamf/claude/falcon/repair-hooks-and-forwarder.sh` when one policy should repair Beacon, install Claude hooks, and start the Vector forwarder. | Parameter | Value | | --------- | --------------------------------------- | | 4 | Falcon HEC endpoint | | 5 | Falcon HEC token | | 6 | Source, default `beacon-endpoint-agent` | | 7 | Sourcetype/parser, default `json` | | 8 | OTLP gRPC port, default `4317` | | 9 | OTLP HTTP port, default `4318` | | 10 | Optional repository/index | For a forwarder-only policy, use `/opt/beacon/jamf/claude/falcon/install-forwarder.sh` with the same endpoint and token. ### Validate hook-only forwarding Confirm Vector is running: ```bash title="Confirm Vector is running" theme={null} sudo launchctl print system/com.beacon.endpoint.falcon-forwarder tail -n 50 /tmp/com.beacon.endpoint.falcon-forwarder.err ``` Generate a unique Claude prompt and confirm it appears locally: ```bash title="Generate a unique Claude prompt and confirm it appears locally" theme={null} MARKER="beacon falcon hook test $(date +%s)" claude -p "$MARKER" sudo grep "$MARKER" /var/log/beacon-agent/runtime.jsonl ``` Search Falcon for the same marker: ```text theme={null} source = "beacon-endpoint-agent" "beacon falcon hook test" ``` ## Validate forwarding Confirm Beacon has the destination configured: ```bash title="Confirm Beacon has the destination configured" theme={null} sudo /opt/beacon/bin/beacon endpoint status --system --json ``` In the JSON output, check that `destinations.falcon_hec.configured` is `true` and that the endpoint, repository, source, and sourcetype match your deployment. The token is not printed. Then write a validation event: ```bash title="Write a validation event" theme={null} sudo /opt/beacon/bin/beacon endpoint falcon validate --system ``` Search Falcon LogScale for the validation event and normalized Beacon fields: ```text theme={null} source = "beacon-endpoint-agent" "Beacon endpoint Falcon validation event" ``` ```text theme={null} vendor = "beacon" product = "endpoint-agent" ``` If events do not appear, verify that the collector service is running, the Falcon HEC endpoint accepts the configured token, the repository name matches the token scope, and TLS settings match your LogScale deployment. ```bash title="Check endpoint status as JSON" theme={null} sudo /opt/beacon/bin/beacon endpoint status --system --json sudo launchctl print system/com.beacon.endpoint.collector ``` ## Content Handling Beacon applies redaction, sanitization, truncation, and event-size limits before events are written locally or forwarded through Falcon HEC. Review repository access, parser behavior, retention, and downstream consumers so retained telemetry matches your approved collection policy. ## Related Review forwarding patterns and validation steps. Roll out Claude hooks and Falcon runtime-log forwarding with Jamf Pro. Configure Falcon HEC forwarding during endpoint install. Add or update Falcon HEC forwarding on an existing endpoint. Review normalized Beacon JSONL fields and example events.