Skip to main content

​
Forwarding Command

Beacon writes Wazuh-compatible JSONL endpoint events to the local runtime log. The beacon endpoint wazuh commands help security and IT teams connect that log to Wazuh localfile ingestion, install Beacon-specific Wazuh rules, and write validation events. Beacon does not require Wazuh credentials and does not call the Wazuh API during normal endpoint operation. Wazuh tails the runtime log from disk and stores decoded Beacon fields under data.* in Wazuh alerts.
Command syntax

​
Commands

beacon endpoint wazuh print-config

Print a Wazuh localfile snippet for the configured runtime log.

beacon endpoint wazuh install-pack

Write Wazuh rules and config snippets to a directory.

beacon endpoint wazuh validate

Write and describe a Beacon validation event.

​
Runtime log paths

Use user mode for local workstation testing. Use system mode for managed endpoint deployments so Wazuh can read a shared, predictable path.

​
beacon endpoint wazuh print-config

beacon endpoint wazuh print-config prints a Wazuh localfile snippet for the configured Beacon runtime JSONL log.
Print the configuration
Use this command when you want to copy the localfile configuration into an existing Wazuh agent configuration. The output looks like:
Install this snippet in the Wazuh agent or manager configuration that can read the Beacon runtime log. For Docker-based Wazuh tests, the <location> must be the container-side path, not the macOS host path.

​
Examples

Print config for the default per-user Beacon install:
Print config for the default per-user Beacon install
Print config for a custom runtime log:
Print config for a custom runtime log

​
Flags

​
beacon endpoint wazuh install-pack

beacon endpoint wazuh install-pack writes Beacon Wazuh rules and configuration snippets to an output directory.
Generate the integration pack
Use the generated content pack when you want a file-based bundle of Wazuh integration artifacts instead of copying only the localfile snippet. The generated pack includes:

​
Examples

Generate a content pack for the default per-user install:
Generate a content pack for the default per-user install
Generate a content pack for a custom runtime log:
Generate a content pack for a custom runtime log
For local Docker validation, generate the pack with the path Wazuh sees inside the container:
Generate the pack for Docker validation

​
Flags

​
beacon endpoint wazuh validate

beacon endpoint wazuh validate writes a Beacon validation event to the runtime JSONL log and describes it, so you can verify localfile ingestion in Wazuh.
Run the validation check

​
Examples

Write a validation event for the default per-user install:
Write a validation event for the default per-user install
Write a validation event to a custom runtime log:
Write a validation event to a custom runtime log
For local Wazuh Docker testing, the --log-path used in print-config or install-pack should usually be the path Wazuh sees inside the container, such as /var/log/beacon-agent/runtime.jsonl. The validate command should write to the host Beacon log path, such as ~/.beacon/endpoint/logs/runtime.jsonl, when that directory is bind-mounted into the Wazuh manager container. The validation event should produce Wazuh rule 100500 with:

​
Flags

​
Wazuh Dashboard fields

In Wazuh Dashboard, Beacon event details appear under data.* fields. Useful columns include:
Useful Wazuh Dashboard filters:
The generated apply-dashboard-default-columns.sh helper can set the recommended OpenSearch Dashboards columns for local Wazuh validation. See Wazuh forwarding for the full Docker setup.

Endpoint agent

Install and inspect the local endpoint agent.

Dashboard

Inspect Beacon events locally before forwarding.