Asymptote-Labs/agent-beacon v1.3.50 on GitHub

Changelog

Other

92925f1 Merge remote-tracking branch 'origin/main' into claude/beacon-fix-a40l94-win-acl
0922127 Merge remote-tracking branch 'origin/main' into claude/beacon-fix-a40l94-win-docs
69aa883 Restricted log access on Windows (--log-access restricted) (#1134)
c7c5e09 Windows restricted mode: final security at creation, list under the lock, marker last
c1d80f3 Windows restricted mode: replace held-open files, and close every file in the log directory
3141567 Windows: the restricted log access mode's ACL, marker and readers group
4357fcc Windows: the restricted log access mode's ACL, marker and readers group (2/5) (#1129)
b4680b6 beacon_ingest: bound the Windows account-name lookup
8ab395a beacon_ingest: let a late name lookup fill the cache
a190c24 beacon_ingest: name a SID with LookupAccountSid alone
ea600a0 beacon_ingest: on Windows, keep the collector up when the pipe's name is taken
3d858ac beacon_ingest: on Windows, wait out only a taken pipe name
e3ce006 beacon_ingest: serve the named pipe on Windows
5bb72a0 doctor: report a too-open restricted log even when it is then refused
c076326 endpoint: offer --log-access restricted on Windows system installs
d2281f6 endpoint: offer --log-access restricted on Windows system installs (4/5) (#1131)
e18b18c localingest: close listeners after releasing the server's lock
cb7caec localingest: give the pipe's owner full control
c9cc55a localingest: on Windows, only SYSTEM and enabled Administrators bypass the pipe
3067227 localingest: on Windows, spool under the token's profile, not USERPROFILE
e26a7b0 localingest: serve and send over a named pipe on Windows
eb53d72 localingest: serve and send over a named pipe on Windows (1/5) (#1127)
2dad61e sysacl: a reader refused the lock goes on checking the rest of the log directory
e5a4d8f sysacl: recognise a restricted log directory by its exact ACL
fb83aa8 windows smoke: detect a refused append by cmd's || rather than its exit code
fecc8fa windows smoke: find the spool under the profile the hook ran in, and show why on a miss
b3b83ae windows smoke: keep the ordinary account's password to 14 characters
bacaea3 writer: compare file ids read at the moment, not lazily, in the Windows restrict tests
7becf24 writer: compare what an untouched file grants, not its inheritance flags
6cc272a writer: going back to shared on Windows restores every file the restriction reset
59bf5ec writer: on Windows, roll a failed restriction back to shared, and replace every file beside the log
d7d7e1e writer: read a file's link count without needing read access to it

Installation

Homebrew (macOS/Linux)

brew update
brew trust asymptote-labs/tap
brew tap asymptote-labs/tap
brew install beacon

Linux (Debian, Ubuntu, Fedora, RHEL)

curl -fsSL https://github.com/asymptote-labs/agent-beacon/releases/download/v1.3.50/install.sh | BEACON_VERSION=1.3.50 bash

Manual Download

Download the appropriate archive for your platform from the assets below, extract it, and add the binary to your PATH.

Quick Start

beacon endpoint install
beacon endpoint status
beacon endpoint wazuh print-config

Threat detection rules

beacon ships with a small built-in baseline. Install the full threat-rule
pack (attached as threat-rules.tar.gz below) and scan your local telemetry:

beacon rules pull https://github.com/asymptote-labs/agent-beacon/releases/download/v1.3.50/threat-rules.tar.gz
beacon rules list
beacon scan