# Install packetbeat with Homebrew, chocolatey, Nix Lightweight Shipper for Network Data. Version 9.4.3 via Homebrew; verified 2026-06-30. ## Install ```sh sudo av install brew:packetbeat ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install packetbeat ``` Evidence: local Homebrew formula metadata ### Linux - Nix (92%): ```sh nix profile install nixpkgs#packetbeat ``` Evidence: nixpkgs package indexes: packetbeat from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix ### Windows - Chocolatey (92%): ```sh choco install packetbeat ``` Evidence: Chocolatey community package catalog: packetbeat from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','openssh' ## Package facts - **Package key:** brew:packetbeat - **Package manager:** Homebrew - **Package manager page:** - **Version:** 9.4.3 - **Source summary:** Lightweight Shipper for Network Data - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** Apache-2.0 - **Source archive:** - **Last updated:** 2026-06-30T19:07:07Z - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - packetbeat (cli) - packetbeat (alias) ## Build dependencies - go - mage ## Uses from macOS - libpcap ## Install behavior - Post-install hook: not defined - Service: declared - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 9.4.3 - Package-manager updated: 2026-06-30 - Local data: ok - Upstream repository: https://github.com/elastic/beats - info: No cached GitHub release or tag data was available. ## Security Notes formula declares a Homebrew service. - **Geiger risk:** orange / medium - formula declares a Homebrew service ## Configuration and credential file locations These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval. ## Configuration files - Linux: /etc/packetbeat/packetbeat.yml - macOS: packetbeat.yml in the Packetbeat installation directory - Windows: C:\Program Files\Packetbeat\packetbeat.yml ## Credential files - Linux: Packetbeat keystore in the directory defined by path.data - macOS: Packetbeat keystore in the directory defined by path.data - Windows: Packetbeat keystore in the directory defined by path.data ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** packetbeat - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Nix - packetbeat: normalized package name match | nixpkgs package indexes: packetbeat from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix - Chocolatey - packetbeat: normalized package name match | Chocolatey community package catalog: packetbeat from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','openssh' ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Database and data packages](https://www.automicvault.com/pkg/database-data-tools/) - Matched database, SQL, migration, or data-store metadata. - [go](https://www.automicvault.com/pkg/brew/go/) - Build dependency declared by Homebrew. - [mage](https://www.automicvault.com/pkg/brew/mage/) - Build dependency declared by Homebrew. - [auditbeat](https://www.automicvault.com/pkg/brew/auditbeat/) - Shares the same upstream source repository. - [filebeat](https://www.automicvault.com/pkg/brew/filebeat/) - Shares the same upstream source repository. - [heartbeat](https://www.automicvault.com/pkg/brew/heartbeat/) - Shares the same upstream source repository. - [metricbeat](https://www.automicvault.com/pkg/brew/metricbeat/) - Shares the same upstream source repository. - [miruo](https://www.automicvault.com/pkg/brew/miruo/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking, packet-analysis. - [ntopng](https://www.automicvault.com/pkg/brew/ntopng/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking, observability. - [bmon](https://www.automicvault.com/pkg/brew/bmon/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking. - [bwm-ng](https://www.automicvault.com/pkg/brew/bwm-ng/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking. - [cloudprober](https://www.automicvault.com/pkg/brew/cloudprober/) - Shares av.db curated category or tags: cli, monitoring, networking, observability. - [fprobe](https://www.automicvault.com/pkg/brew/fprobe/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking. - [ifstat](https://www.automicvault.com/pkg/brew/ifstat/) - Shares av.db curated category or tags: cli, monitoring, network-monitoring, networking. ## Combined YAML source View the package source record on GitHub. [combined/packetbeat.yml](https://github.com/automic-vault/db/blob/main/combined/packetbeat.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated configuration and credential file locations - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph