Watch the shell commands being executed actively. This beacon requires strace.
Scan the shell execve routines. This beacon will convert all login shells
beacons: sh: []
Validate the beacon configuration
beacon()
validate()