$ account activecm
BeaKer is a self-contained threat-hunting deployment for Windows network beacon detection. It provisions an Elasticsearch/Kibana backend with Docker Compose, configures Windows endpoints via a PowerShell agent installer, and ships prebuilt index templates, ingest pipelines, and Kibana dashboards for Sysmon event data. The dominant character is an application/infrastructure project: the core artifacts are deployment scripts, Ansible playbooks, and ELK configuration rather than a library or data analysis framework. A secondary data-pipeline nature is visible in the Elasticsearch ingest pipelines that normalize Windows Security/PowerShell/Sysmon events into ECS, and in the export/import tooling for dashboards and indices.