Everything you need to use Beacon.

Start here if you've never touched a network-analysis tool before. Every page explains the jargon the first time it comes up. If something's unclear, email us and we'll fix it.

Getting started

Quickstart

From signup to your first confirmed beacon.

Supported formats

PCAP, Zeek, Suricata, NDJSON, CSV.

Field mapping

Onboarding exports with unusual column names.

Detection

Behavioral scoring

How every pair gets a beacon score.

Fingerprinting

JA3, JA4, JA4H, and JA4X explained.

Threat intel

Which feeds, how they're applied.

Severity modifiers

What pushes a score's severity up or down.

Workflow

Investigation panel

The interface you'll live in day-to-day.

False-positive learning

Mark once, suppress across the workspace.

Exports and reports

CSV, Executive PDF, IR Handoff PDF.

API and integrations

REST API

Programmatic ingest, lookup, and feedback.

Soon

Webhooks

Push detections into Slack, PagerDuty, or your SIEM.

Soon

Need something the docs don't cover yet?

We're writing docs alongside early customers. If you hit a wall, email us. You'll get an answer from the person who built the feature.

Email support