{
 "schema_version": 1,
 "generated": "2026-10-26",
 "id": "asymptote-labs-agent-beacon--forward-agent-sessions-to-your-siem",
 "repo": "Asymptote-Labs/agent-beacon",
 "repo_url": "https://github.com/Asymptote-Labs/agent-beacon",
 "repo_slug": "asymptote-labs-agent-beacon",
 "title": "Send coding agent activity to your SIEM",
 "page_title": "How to send coding agent activity to your SIEM with Agent Beacon",
 "summary": "Forward normalized agent session history to Splunk, Datadog, Elastic, Sentinel or a bucket for security review.",
 "who": "A security engineer asked which commands and MCP calls the company's coding agents ran last week.",
 "problem": "Every coding tool logs differently, if at all, so agent activity is invisible to the security stack.",
 "outcome": "One OpenTelemetry-based stream of agent sessions, tool calls, commands and approvals in the SIEM you already run.",
 "steps": [
  "Install Beacon on each machine; system, package, MDM and CI install paths are noninteractive and account-free",
  "During `beacon endpoint install` (or a repair), set up endpoint forwarding to Splunk HEC or CrowdStrike Falcon LogScale HEC",
  "For Microsoft Sentinel, Sumo Logic, Wazuh or Rapid7 InsightIDR, apply the matching Beacon content pack; for Datadog or Elastic, collect the local JSONL with their agent",
  "Keep the local JSONL as the default copy, or ship it to AWS S3 or Google Cloud Storage",
  "Review sessions in the dashboard's security review lens, grouped by risk"
 ],
 "agent_prompt": "Install Asymptote-Labs/agent-beacon on <machine> and forward its endpoint telemetry to <Splunk HEC endpoint or other SIEM>. Run one <harness> session, then confirm the session's prompts, commands and approvals arrive in the SIEM and match ~/.beacon/endpoint/logs/runtime.jsonl.",
 "agents": [
  "any"
 ],
 "difficulty": "Advanced",
 "time": "1 hour",
 "basis": "readme",
 "caveat": "The README lists the supported destinations and content packs but leaves the per-SIEM steps to docs.beacon.sh, so plan to follow those pages for your destination.",
 "category": "Software and DevOps",
 "tags": [
  "Software and DevOps"
 ],
 "lang": "go",
 "requirements": [
  "macOS with Homebrew, Linux (Debian, Ubuntu, Fedora, RHEL, Rocky or Alma, as .deb or .rpm) or Windows x64 (MSI)",
  "At least one supported harness, such as Claude Code, Codex CLI, Cursor or OpenCode",
  "A beacon.sh sign-in only if you choose Beacon Cloud; Local needs no account",
  "For forwarding: an existing destination such as Splunk HEC, Datadog, Elastic, Microsoft Sentinel or an S3 or GCS bucket"
 ],
 "risk": "none",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [
  {
   "tag": "credentials",
   "notice": "Forwarding sends prompts, commands and file activity off the machine, and setup needs ingest tokens such as a Splunk or LogScale HEC token; store them as secrets and tell developers what is captured."
  }
 ],
 "best": false,
 "score": 0.8,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/asymptote-labs-agent-beacon/forward-agent-sessions-to-your-siem/",
 "md": "https://dedupedai.com/use-cases/asymptote-labs-agent-beacon/forward-agent-sessions-to-your-siem/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/asymptote-labs-agent-beacon--forward-agent-sessions-to-your-siem.json",
 "api_version": "v1"
}