Skip to main content

​
Command overview

beacon rules list prints the active threat-detection rules used by beacon scan.
Command syntax
The output includes each rule id, severity, maturity status, and source. The source shows whether Beacon loaded the rule from the local store or the built-in baseline, and the closing line counts the rules from each. The built-in baseline stays active alongside the store. A store rule replaces a baseline rule only when it has the same id, so installing your own rules adds to the baseline rather than switching it off.

​
Examples

List active user-mode rules:
List active rules
List active system-mode rules:
List system-mode rules

​
Flags

beacon rules add

Install local rule files into the store.

beacon scan

Run active rules over local telemetry.