Asymptote-Labs/agent-beacon v0.0.11 on GitHub

What's New

Beacon v0.0.11 adds Elastic integration support for endpoint telemetry. Teams can now forward Beacon's local runtime.jsonl events into Elasticsearch and Kibana with Filebeat or standalone Elastic Agent, while keeping Elastic hosts and credentials outside Beacon's endpoint configuration.

Elastic Integration

Added beacon endpoint elastic install-pack to generate an Elastic content pack with Filebeat config, standalone Elastic Agent config, Elasticsearch templates, an ingest pipeline, ILM policy, Kibana starter assets, and a sample event fixture.
Added beacon endpoint elastic up and beacon endpoint elastic down for a loopback-only local macOS validation stack with Elasticsearch, Kibana, and Filebeat.
Added beacon endpoint elastic print-config for quickly printing the Filebeat input that tails Beacon endpoint JSONL.
Events land under the logs-beacon.endpoint-* data stream pattern with ECS-oriented mappings and an ingest pipeline for Beacon endpoint fields.

Getting Started With Elastic

For a local macOS trial with Docker Desktop:

brew tap asymptote-labs/tap
brew install beacon

beacon endpoint install
beacon endpoint elastic up

Then open Kibana at http://localhost:5601 and use the Beacon Endpoint Events data view in Discover. Stop the local stack with:

beacon endpoint elastic down

For Elastic Cloud or a self-managed Elastic deployment:

beacon endpoint install
beacon endpoint elastic install-pack --output ./beacon-elastic-pack

Install the JSON assets from the generated pack, then run Filebeat or standalone Elastic Agent with ES_HOSTS plus one authentication method such as ES_API_KEY. Beacon continues writing local JSONL and does not store Elastic hosts, API keys, usernames, or passwords.

Installation

Homebrew (macOS/Linux)

brew tap asymptote-labs/tap
brew install beacon

Manual Download

Download the appropriate archive for your platform from the assets below, extract it, and add the binary to your PATH.

Quick Start

beacon endpoint install
beacon endpoint status
beacon endpoint elastic install-pack --output ./beacon-elastic-pack