Skip to main content

​
Command overview

beacon rules pull downloads a rule file or rule pack from an explicit URL and installs valid rules into the local store.
Command syntax
This is the only beacon rules command that reaches the network, and only when you run it. Beacon never fetches rules on its own. The full Beacon threat-rule pack is published as a versioned threat-rules.tar.gz asset on each Agent Beacon GitHub release.

​
Supported inputs

beacon rules pull accepts: Downloaded tarballs only install .rule.yaml entries. Archive entries containing path traversal elements are rejected before install.

​
Transport and integrity

Rules decide what beacon scan can see, so a pull refuses sources that a network attacker could tamper with:
  • The URL must use https://. Plain http:// is accepted only for a loopback host (localhost, 127.0.0.1, ::1), for testing a pack served from your own machine.
  • Redirects are followed only while they stay on https:// (for example, a GitHub release download redirecting to its storage host). A redirect from https:// to http://, or to a host the command would not have accepted directly, stops the pull.
  • With --sha256 <hex>, Beacon hashes the downloaded bytes and installs nothing unless they match. Use the SHA-256 digest the publisher lists for the asset; GitHub shows one for every release asset. Without --sha256, Beacon prints the digest of what it downloaded so you can compare it yourself.
The whole download is read and checked before anything is unpacked or written to the store, and these limits apply: The published rule pack is about 50 KB compressed, with under 100 entries and about 300 KB decompressed. A source over any limit fails with an error that names the limit, and nothing is installed. Installing rules never switches off the built-in baseline: a pulled rule replaces a baseline rule only when it has the same id.

​
Examples

Pull a rule pack:
Pull a rule pack
Pull a rule pack and verify it against the asset’s published SHA-256 digest:
Pull and verify a rule pack
Pull one rule file:
Pull one rule file
Overwrite an existing rule with the same id:
Overwrite existing rules
Install into the system-mode rule store:
Pull system-mode rules

​
Flags

beacon rules lint

Validate a rule pack before publishing or installing.

beacon rules list

Confirm the installed active rules.