Asymptote Open Source
Asymptote Open Source is the open-source telemetry path built on Agent Beacon. It collects supported agent activity across local endpoints, CI jobs, and cloud-agent surfaces, normalizes that activity into Beacon-compatible records, and leaves storage and forwarding under customer control. See Open Source deployment.Agent Beacon
Agent Beacon is the local-first endpoint telemetry agent in theagent-beacon repository. Beacon configures supported agent harnesses, receives OTLP or hook telemetry, writes local JSONL, serves the local dashboard, and can generate forwarding content for customer-managed destinations.
Asymptote Managed
Asymptote Managed is the hosted Asymptote operating model for centralized ingest, retention, search, detections, fleet visibility, policy controls, identity mapping, approvals, SSO, RBAC, audit trails, and investigation workflows. See Managed deployment.Private Deployment
Private Deployment applies managed capabilities with stronger infrastructure ownership, data isolation, residency, or custom retention requirements. See Hosting Options.Endpoint Agent
The endpoint agent is the local Beacon service and configuration managed bybeacon endpoint. It is Beacon’s local collection path: it configures supported agent harnesses, runs the local collector, writes endpoint events to JSONL, and supports inspection, repair, dashboard, Wazuh, hooks, and forwarding commands.
Runtime Surface
A runtime surface is the telemetry interface exposed by an agent harness. Beacon supports different surfaces because each agent harness exposes activity differently, including local OpenTelemetry configuration, hook adapters, CI wrappers, cloud sandbox hooks, SDK instrumentation, admin-configured OpenTelemetry, and gateway-configured OTLP/HTTP export. See Runtime Surface Overview.Agent Harness
An agent harness is the runtime or integration that produced an event. It can be a local coding agent, a CI job, a cloud-agent surface, an SDK-instrumented application, an admin-configured service integration, or a gateway-managed runtime surface. Examples includeclaude, codex, gemini_cli, grok, opencode, devin-cli, devin-desktop, factory, cursor, claude_cowork, and openclaw_gateway. Beacon stores harness context in normalized events so investigators can filter by the source that generated the activity.
CI Telemetry
CI telemetry is agent runtime telemetry captured during ephemeral build jobs. Beacon can run a temporary collector throughbeacon ci exec or beacon ci start / beacon ci finish, write a completed runtime.jsonl, and export that file as an artifact or upload target. See CI Telemetry Exports.
Cloud-Agent Telemetry
Cloud-agent telemetry is activity captured from provider-managed cloud agent sandboxes. Beacon cloud helpers print hook and storage setup so cloud sessions can produce Beacon-compatibleruntime.jsonl artifacts, currently with self-serve Google Cloud Storage upload paths for supported cloud agents.
Observe SDK
The Observe SDK is the@asymptote/sdk TypeScript package for instrumenting cloud-hosted agent applications, services, workers, serverless functions, and agent SDK integrations. It can export to Asymptote Managed hosted Observe or to a customer-managed OTLP collector. See Asymptote Observe SDK.
Local Collector
The local collector is Beacon’s OpenTelemetry Collector pipeline on the endpoint. It receives OTLP from supported agent harnesses, batches and processes telemetry, writes normalized Beacon JSONL through thebeaconjson exporter, and can optionally send collector signals to Splunk HEC or Falcon LogScale HEC.
OTLP
OTLP is the OpenTelemetry Protocol used by runtimes to send logs, traces, metrics, and resource attributes to Beacon. Local installs commonly use127.0.0.1:4317 for OTLP gRPC and 127.0.0.1:4318 for OTLP HTTP.
Hooks
Hooks are runtime-managed integration points that invoke Beacon’sbeacon-hooks adapter. Supported hook runtimes capture session, prompt, tool, command, approval, MCP-like, permission, and file edit events where those runtimes expose payloads.
Endpoint Event
An endpoint event is one normalized Beacon JSON object describing runtime activity. Endpoint events include a stableevent action, endpoint context, harness context, severity, and any optional entities the source provides. CI and cloud telemetry paths use the same Beacon-compatible event model where their collection path emits normalized records. See Endpoint event schema.
Entity Model
The entity model is Beacon’s shared shape for runtime-specific payloads. Each event has an action plus typed context such asendpoint, user, harness, origin, run, session, tool, file, command, mcp, approval, policy, prompt, content, gen_ai, destination, and health. See Telemetry fields.
Threat Rules
Threat rules are local detection rules that match Beacon endpoint events and produce findings. Beacon’sscan command runs the active rule corpus over local or CI JSONL without requiring hosted ingest. See Detections.
Findings
Findings are detection results produced when threat rules match runtime activity. They summarize the matched event, rule metadata, severity, and evidence so operators can review suspicious agent behavior in the local dashboard or downstream systems.Runtime JSONL Log
The runtime JSONL log is Beacon’s local audit log for endpoint collection. User-mode installs write to~/.beacon/endpoint/logs/runtime.jsonl; system-mode installs write to /var/log/beacon-agent/runtime.jsonl. Each line is a complete Beacon endpoint event. Beacon keeps that active runtime.jsonl path stable for dashboards and shippers, and rotates it at 10 MiB with five numbered local archives such as runtime.jsonl.1.
Wazuh Localfile
Wazuh localfile ingestion reads Beacon’s runtime JSONL log from disk. Beacon can print localfile configuration, generate rule packs and sample events, and write validation events for Wazuh ingestion tests.Splunk HEC
Splunk HEC is Splunk HTTP Event Collector. Beacon can optionally configure a collector exporter that forwards OTLP logs, traces, and metrics to a customer-managed Splunk HEC endpoint while preserving the local JSONL audit log.Falcon LogScale HEC
Falcon LogScale HEC is CrowdStrike Falcon LogScale’s HTTP Event Collector ingest path. Beacon can optionally configure a collector exporter that forwards normalized OTLP logs, traces, and metrics to a customer-managed Falcon LogScale HEC endpoint while preserving the local JSONL audit log.Elastic Content Pack
The Elastic content pack is Beacon’s generated Filebeat, standalone Elastic Agent, Elasticsearch, and Kibana content for shipping local Beacon JSONL into Elastic. The pack reads the runtime log; Beacon itself does not store Elastic cluster URLs or credentials.Datadog Content Pack
The Datadog content pack is Beacon’s generated Datadog Agent custom log collection content for shipping local Beacon JSONL into Datadog Logs. The pack reads the runtime log; Beacon itself does not store Datadog API keys or site configuration.Microsoft Sentinel Content Pack
The Microsoft Sentinel content pack is Beacon’s generated Azure Monitor Agent and Log Analytics custom log content for shipping local Beacon JSONL into Microsoft Sentinel. The pack reads the runtime log; Beacon itself does not store Azure tenant IDs, client secrets, workspace IDs, DCR identifiers, or ingestion endpoints.AWS CloudWatch Logs Content Pack
The AWS CloudWatch Logs content pack is Beacon’s generated Vector forwarding template, setup guidance, and sample events for shipping local Beacon JSONL into a customer-managed CloudWatch Logs log group. The pack reads the runtime log; Beacon itself does not store AWS credentials, IAM roles, log group retention, stream naming, or encryption settings.Sumo Logic Content Pack
The Sumo Logic content pack is Beacon’s generated setup guidance, upload smoke-test script, Vector forwarding template, and sample events for shipping local Beacon JSONL into a Sumo Logic Hosted Collector HTTP Logs & Metrics Source. The pack reads the runtime log; Beacon itself does not store Sumo Source URLs, tokens, or collector configuration.Rapid7 Content Pack
The Rapid7 content pack is Beacon’s generated setup guidance, NDJSON upload smoke-test script, Vector forwarding template, and sample events for shipping local Beacon JSONL into a Rapid7 InsightIDR Custom Logs webhook event source. The pack reads the runtime log; Beacon itself does not store Rapid7 webhook URLs or tokens.AWS S3 Content Pack
The AWS S3 content pack is Beacon’s generated setup guidance, AWS CLI smoke-test script, Vectoraws_s3 forwarding template, and sample events for shipping local Beacon JSONL into an S3 bucket. The pack reads the runtime log; Beacon itself does not store AWS credentials, bucket policies, lifecycle rules, or encryption settings.
Google Cloud Storage Content Pack
The Google Cloud Storage content pack is Beacon’s generated setup guidance, GCS upload smoke-test script, Vectorgcp_cloud_storage forwarding template, and sample events for shipping local Beacon JSONL into a GCS bucket. The pack reads the runtime log; Beacon itself does not store Google Cloud credentials, service accounts, workload identity settings, bucket IAM, lifecycle rules, retention policies, or encryption settings.
Vector Forwarding
Vector forwarding means a customer-managed Vector host agent tails Beacon’s localruntime.jsonl, parses each JSON line, and delivers events to a downstream destination such as Sumo Logic, Rapid7 InsightIDR, Falcon LogScale, AWS CloudWatch Logs, AWS S3, or Google Cloud Storage. Vector owns checkpointing, batching, retries, credentials, and destination-specific settings.
Customer-Managed Forwarding
Customer-managed forwarding means an existing shipper, agent, Vector host agent, or SIEM pipeline reads Beacon’s runtime JSONL log and routes each line to a downstream destination.Dashboard
The dashboard is a loopback-only local view over Beacon runtime logs. It includes Log Search for investigating events, Detections and Findings for reviewing local threat-rule matches, and Security Overview for summarizing local activity, risk signals, harnesses, models, repositories, MCP servers, and runtime inventory without requiring a hosted Beacon account.Agent Runtime Inventory
Agent Runtime Inventory is Beacon’s local view of configured, detected, and observed runtime coverage. It helps operators confirm which supported agent harnesses are present, which telemetry surfaces Beacon manages, which MCP servers are referenced by local configs, and which runtimes have recently produced events in the configured runtime log.Content Handling
Content handling describes how Beacon treats supported prompt, command, attribute, and diff content before writing endpoint events. Beacon applies redaction, sanitization, truncation, and event-size limits before local storage or configured forwarding.User Mode And System Mode
User mode uses per-user paths under~/.beacon/endpoint and is the default for local evaluation. System mode uses root-managed paths under /Library/Application Support/Beacon/Endpoint and /var/log/beacon-agent, which is the preferred mode for packaged or MDM deployments.
Related
Hosting Options
Compare Asymptote Open Source, Managed, and Private Deployment paths.
Open Source Architecture
See how runtime telemetry flows through collection, normalization, and local outputs.
Endpoint event schema
Review normalized Beacon JSONL fields and example events.
Detections
Learn how threat rules turn endpoint events into findings.
Agent harness integrations
Compare supported agent harnesses, deployment modes, storage, and forwarding.
Inventory Local Agent Runtimes
Understand configured, detected, and observed local runtime coverage.
Log forwarding
Forward Beacon events into Wazuh, Splunk HEC, Falcon LogScale, Elastic, Datadog, Sumo Logic, Rapid7 InsightIDR, Microsoft Sentinel, AWS S3, Google Cloud Storage, or customer-managed pipelines.
Asymptote Observe SDK
Instrument cloud-hosted agent applications with hosted or customer-managed export.