BE HUBScripts
A script is a piece of text with {{variables}}. When you run it, the hub renders it once per machine, sends it as an approved shell command, and keeps the rendered text, the exit code and the output as a run record. Nothing runs by itself: a person presses run, and a machine whose local allow_shell is off refuses it, script or not.
Where scripts come from
Three ways in:
- Save as script on any command BE AI proposed, in the approval queue, on the Proposals page, or inside a conversation. The editor opens with the command, the reason as the description, the machine's platform and company, and the machine's own name already replaced by
{{hostname}}. - + script under Scripts, for something you already have. Paste the text; variables are picked out as you type.
- Copy an existing script to make a variant.
Each script belongs somewhere: shared (every company sees it; only a superadmin edits it), one company (its people run and edit it), or pinned to one machine (it appears only on that machine's scripts tab). Scripts also carry a platform: Windows, Linux, macOS or any. The run panel only offers machines that match.
Variables
Write {{name}} anywhere in the text. Each variable has a source:
| source | what happens at run time |
|---|---|
| asked when run | the person running it types the value. Mark it required (the run is refused without it) or give a default. Mark it secret and it is typed as a password and left out of the stored run record. |
| from the machine | the hub fills it from what it knows: hostname, display_name, name, agent_id, os, arch, version, tenant, primary_ip, gateway, external_ip, public_ip, tags, or tag:<dimension> for the group under a dimension (a machine tagged site/Melbourne/Level 3 gives {{tag:site}} = Melbourne/Level 3). |
| fixed | always the same value, kept with the script so the text stays readable. |
A placeholder named like a device field ({{hostname}}, {{tag:site}}) is detected as one automatically; anything else starts as a question. Quoting is yours: the hub substitutes text and nothing else, so quote a value the way the shell on that platform expects.
Running one
Press run on a script, tick the machines (only online machines of the right platform and company are offered; a device reached through a proxy is not), fill in the questions, and read the preview: it shows the exact text the first ticked machine will receive, with every variable filled. The run button asks for a second press. Up to 50 machines per run, five at a time; each machine's exit code and output appear as they come back, and the run also shows under the machine's scripts tab and on the Scripts › runs tab.
Every run is a normal shell command on the machine, approved by the person who pressed run and written to the audit trail with the script name and the rendered text. Keep scripts idempotent where you can: the same one will be run again on the next machine that needs it.
BE AI and the library
During an investigation BE AI can look the library up and will prefer a saved script that fits over writing a new command, referring to it by name in what it proposes. Questions stay as {{name}} in what it sees; the machine's own values are filled in. It still only proposes: a script run BE AI suggests waits in the approval queue like any other action.
Try it on one machine first.
The install line takes a minute. Uninstall the agent and you are out.