DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to send coding agent activity to your SIEM with Agent Beacon

Forward normalized agent session history to Splunk, Datadog, Elastic, Sentinel or a bucket for security review.

Short answer: Install Beacon on each machine; system, package, MDM and CI install paths are noninteractive and account-free; then During beacon endpoint install (or a repair), set up endpoint forwarding to Splunk HEC or CrowdStrike Falcon LogScale HEC; For Microsoft Sentinel, Sumo Logic, Wazuh or Rapid7 InsightIDR, apply the matching Beacon content pack; for Datadog or Elastic, collect the local JSONL with their agent. All steps.

Credentials. Forwarding sends prompts, commands and file activity off the machine, and setup needs ingest tokens such as a Splunk or LogScale HEC token; store them as secrets and tell developers what is captured.

Who it is forA security engineer asked which commands and MCP calls the company's coding agents ran last week.

The problemEvery coding tool logs differently, if at all, so agent activity is invisible to the security stack.

The outcomeOne OpenTelemetry-based stream of agent sessions, tool calls, commands and approvals in the SIEM you already run.

What you need first

  • macOS with Homebrew, Linux (Debian, Ubuntu, Fedora, RHEL, Rocky or Alma, as .deb or .rpm) or Windows x64 (MSI)
  • At least one supported harness, such as Claude Code, Codex CLI, Cursor or OpenCode
  • A beacon.sh sign-in only if you choose Beacon Cloud; Local needs no account
  • For forwarding: an existing destination such as Splunk HEC, Datadog, Elastic, Microsoft Sentinel or an S3 or GCS bucket

Steps

  1. Install Beacon on each machine; system, package, MDM and CI install paths are noninteractive and account-free
  2. During beacon endpoint install (or a repair), set up endpoint forwarding to Splunk HEC or CrowdStrike Falcon LogScale HEC
  3. For Microsoft Sentinel, Sumo Logic, Wazuh or Rapid7 InsightIDR, apply the matching Beacon content pack; for Datadog or Elastic, collect the local JSONL with their agent
  4. Keep the local JSONL as the default copy, or ship it to AWS S3 or Google Cloud Storage
  5. Review sessions in the dashboard's security review lens, grouped by risk

Prompt for your agent

Install Asymptote-Labs/agent-beacon on <machine> and forward its endpoint telemetry to <Splunk HEC endpoint or other SIEM>. Run one <harness> session, then confirm the session's prompts, commands and approvals arrive in the SIEM and match ~/.beacon/endpoint/logs/runtime.jsonl.

Caveat. The README lists the supported destinations and content packs but leaves the per-SIEM steps to docs.beacon.sh, so plan to follow those pages for your destination.

Use this in your AI agent

Ask your agent

Using the Deduped MCP, get the setup steps for Asymptote-Labs/agent-beacon and "Send coding agent activity to your SIEM"

Add Deduped to Claude Code once

claude mcp add --transport http deduped https://dedupedai.com/mcp

Cursor, ChatGPT, others

Share: X LinkedIn Hacker News Email Copy link

Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer