Changelog
Other
- [d7822b] Address review: Fleet wrapper settings, automation sudo, Installer.app check
- [909437] Address review: Windows account names and supervised MSI installs
- [2a4b7c] Address review: dashboard switch for accounts that cannot read config.json
- [c711ff] Address review: settings reach both steps, safer restricted default
- [2daa8b] Attribute OTLP events to the account that sent them on macOS and Windows (#1211)
- [b77cc1] Attribute OTLP exports to their sender on macOS and Windows
- [1eb95c] CleanPart now returns "" when the value still contains a / after trimming.
- [f76dd0] CleanPart now returns "" when the value still contains a / after trimming. (#1209)
- [f773d6] Dashboard: per-launch secret and an administrator off switch
- [93cb1c] Dashboard: per-launch secret and an administrator off switch (#1212)
- [3e68c4] Fix the macOS install script's log-readers block after the rebase
- [0bb752] Install scripts: read BEACON_LOG_ACCESS in any case, as the CLI does
- [7833dc] Keep the settings file's Splunk token out of per-user processes
- [dd9e37] Linux installs: detect a person by the controlling terminal, not stdin
- [2313c6] Merge main (#1211, peer attribution on macOS and Windows) into the restricted-by-default install branch
- [27241a] Merge main into the restricted-by-default Linux install branch
- [eb41ea] Merge main into the restricted-by-default Linux package branch
- [9e1269] Merge remote-tracking branch 'origin/main' into claude/beacon-system-install-attribution-0cqfvg
- [0ec860] Read the postinstall's own output in the rpm smoke lane
- [068e36] Remove the dashboard marker on every uninstall, and roll it back
- [f33ee8] Restrict the system log on a first Linux package install
- [7e7ae3] Restrict the system log on first package installs on macOS and Windows too
- [6f5376] Restricted system log on first package installs, with fleet settings, on Linux, macOS and Windows (#1202)
- [9814e7] Roll back the log a failed first install created, so a retry is still first
- [7bfae2] Windows marker tests: protect the fixture directory's DACL
- [ecb128] collector: bound
componentswhen a child holds its pipe; fast ci fakes - [f04c07] collector: render peer attribution on macOS and Windows only for a capable collector
- [03d258] loggroup: read net.exe's error number only from its own output
- [c0d321] peercred: refuse closed client rows in the Windows TCP table
- [e4bedb] release signing: accept sqv, harden the apt key steps, fix stale comments
- [1adad8] release: pin the Linux release key and document the apt repository
- [ec24e3] release: pin the Linux release key and document the apt repository (#1210)
- [3dbd1e] selfupdate: compute the apt key's fingerprint in Go, not with gpg
Installation
Homebrew (macOS/Linux)
:::bash
brew update
brew trust asymptote-labs/tap
brew tap asymptote-labs/tap
brew install beacon
Linux (Debian, Ubuntu, Fedora, RHEL)
:::bash
curl -fsSL https://github.com/asymptote-labs/agent-beacon/releases/download/v1.3.58/install.sh | BEACON_VERSION=1.3.58 bash
Manual Download
Download the appropriate archive for your platform from the assets below, extract it, and add the binary to your PATH.
Quick Start
:::bash
beacon endpoint install
beacon endpoint status
beacon endpoint wazuh print-config
Threat detection rules
beacon ships with a small built-in baseline. Install the full threat-rule
pack (attached as threat-rules.tar.gz below) and scan your local telemetry:
:::bash
beacon rules pull https://github.com/asymptote-labs/agent-beacon/releases/download/v1.3.58/threat-rules.tar.gz
beacon rules list
beacon scan
