Skip to main content

​
Command Overview

beacon scan can filter displayed findings and return a non-zero exit code when findings meet a severity threshold. Use these flags when you want a local check in rollout scripts, CI validation jobs, or support workflows that should stop on high-risk telemetry.

​
Filter displayed findings

Only print findings at or above a minimum severity:
Only show high and critical findings
Accepted severity values are:

​
Fail on findings

Exit non-zero if any finding is at or above a severity threshold:
Fail on high-severity findings
The --fail-on check evaluates every finding from the scan before --min-severity filters display output. This keeps the exit code accurate even when the printed output is narrowed.

​
JSON output

Combine JSON output with severity gates for automation:
JSON output with a severity gate
For copied runtime logs or artifacts, point the scan at the file explicitly:
Scan an exported runtime log

Run local scans

Choose logs, rules, sessions, and output formats.

beacon rules lint

Validate rule packs before using them in automation.