Skip to main content

​
Command Overview

beacon scan runs active threat-detection rules over the local Beacon runtime log and reports findings. The scan is read-only and never touches the network.
Command syntax
Use this command after endpoint telemetry is flowing when you want a local risk check before forwarding events, sharing diagnostics, or gating a CI-like validation workflow.

​
How scanning works

Beacon loads rules from the local rule store when present. If no store is installed, Beacon uses the built-in baseline rules. You can also point a scan at an explicit rule directory with --rules. Rules are YAML documents with CEL expressions over the Beacon Endpoint Event Schema. Rules can match one event or correlate multiple ordered events within one session window.

​
Workflows

Run local scans

Choose runtime logs, rule directories, sessions, and output formats.

Use scan gates

Filter findings and fail automation on severity thresholds.

​
Examples

Run the active rules over the default per-user endpoint log:
Run a local scan
Print machine-readable findings:
Print JSON findings
Only report high and critical findings:
Filter by severity
Fail the command when any high or critical finding is present:
Fail on high-severity findings
Scan a copied runtime log with a local rule pack:
Scan an explicit log and rules directory
Filter to one session id substring:
Scan one session

​
Flags

beacon rules

Manage, pull, and author threat-detection rules.

Detections

Learn how detection rules, fixtures, and findings work.

Endpoint dashboard

Inspect the same runtime logs locally before or after scanning.