Skip to main content

​
Command overview

beacon scan runs active threat-detection rules over the local Beacon runtime log and reports findings. The scan is read-only and never touches the network.
Command syntax
Use this command after endpoint telemetry is flowing when you want a local risk check before forwarding events, sharing diagnostics, or gating a CI-like validation workflow.

​
How scanning works

Beacon runs the rules in the local rule store plus every built-in baseline rule the store does not replace by id; with no store installed, that is the baseline alone. You can also point a scan at an explicit rule directory with --rules, which runs only that directory. Rules are YAML documents with CEL expressions over the Beacon Endpoint Event Schema. Rules can match one event or correlate multiple ordered events within one session window.

​
Workflows

Run local scans

Choose runtime logs, rule directories, sessions, and output formats.

Use scan gates

Filter findings and fail automation on severity thresholds.

​
Examples

Run the active rules over the default per-user endpoint log:
Run a local scan
Print machine-readable findings:
Print JSON findings
Only report high and critical findings:
Filter by severity
Fail the command when any high or critical finding is present:
Fail on high-severity findings
Scan a copied runtime log with a local rule pack:
Scan an explicit log and rules directory
Filter to one session id substring:
Scan one session

​
Flags

beacon rules

Manage, pull, and author threat-detection rules.

Detections

Learn how detection rules, fixtures, and findings work.

Endpoint dashboard

Inspect the same runtime logs locally before or after scanning.