Run a raw OpenSearch DSL query. Returns the raw response (hits + aggregations). Aggregations honor the time filter inside the DSL body, so there is no hidden default time window.

Args: index: index or pattern (e.g. "arkime_sessions3-*"). query_dsl: JSON string of a full DSL body ({"query": {...}, "aggs": {...}}). size: max hits (0 for aggregation-only). Always wins over a "size" key inside query_dsl.

Count documents matching a DSL query clause (default match_all).

List indices (name/health/status/doc count).

Field mapping/schema for an index.

OpenSearch cluster health.

Search Malcolm indexed network traffic documents.

Uses Malcolm's simple filter syntax (NOT OpenSearch DSL).

Filter examples: {"event.dataset": "conn"} -- Zeek conn logs {"source.ip": "192.0.2.77"} -- by source IP {"event.dataset": "dns", "zeek.dns.query": "example.com"} {"!network.transport": "icmp"} -- exclude ICMP {"network.direction": ["inbound", "outbound"]} -- OR match {"!related.password": null} -- field must exist

Args: filters: JSON filter object (Malcolm filter syntax). limit: Maximum documents to return (1-500). time_from: Start time (dateparser format, e.g. "2024-01-01", "7 days ago"). time_to: End time (default: now).

Aggregate network traffic by one or more fields.

Returns bucket counts (top-N values) for the requested fields. For multi-level aggregation, pass comma-separated fields.

Args: fields: Comma-separated field names to aggregate on. e.g. "network.protocol" e.g. "source.ip,destination.ip,network.protocol" e.g. "suricata.alert.signature,suricata.alert.severity" filters: JSON filter object (Malcolm filter syntax). limit: Maximum buckets per aggregation level (1-500). time_from: Start time (dateparser format). time_to: End time (default: now).

Search Suricata alerts with structured parameters.

Builds the correct Malcolm filters automatically -- you do NOT need to know whether the field is suricata.alert.signature or rule.name.

Args: signature: Alert signature substring (e.g. "ET MALWARE", "CVE-2024"). severity: Comma-separated severity levels, e.g. "1,2" (1=high, 2=medium, 3=low). source_ip: Filter by source IP. dest_ip: Filter by destination IP. limit: Maximum alerts to return. time_from: Start time (dateparser format). time_to: End time (default: now).

Search available field names in Malcolm's index.

Use this tool BEFORE querying to verify field names exist. Malcolm uses NON-STANDARD field names (e.g. http.useragent, NOT http.user_agent).

Args: keyword: Substring to search in field names (e.g. "useragent", "signature"). prefix: Field name prefix (e.g. "zeek.dns", "suricata.alert", "rule"). field_type: Filter by type (e.g. "keyword", "ip", "long", "date").

At least one parameter should be provided. Results sorted alphabetically.

List distinct values for a field with document counts.

Use this to discover what values a field actually contains BEFORE using it in a filter. Prevents value hallucination.

Examples: field="event.dataset" -> ["conn", "dns", "ssl", "http", "alert", ...] field="network.protocol" -> ["tcp", "udp", "icmp", ...] field="suricata.alert.severity" -> [1, 2, 3] field="event.severity_tags" -> ["Informational", "Warning", ...]

Args: field: The field to enumerate values for. limit: Maximum number of distinct values to return. filters: Optional JSON filter to scope the enumeration. time_from: Start time. time_to: End time.

Show which event.dataset types contain a specific field.

Helps determine if a field is available for a given data type. For example, zeek.ssl.server_name only exists in SSL records.

Args: field: The field name to profile. time_from: Start time. Omit = recent-only; pass a range for historical data. time_to: End time.

Check Malcolm service health and version info.

Returns readiness of all services (OpenSearch, Arkime, NetBox, Logstash, etc.) plus Malcolm version and OpenSearch cluster health. Call this before a hunt to ensure all services are available.

Show data freshness, sensor status, and dataset distribution.

Reports:

• Which sensors are feeding data and their latest timestamps

• How old the most recent data is

• Document counts per event.dataset (conn, dns, ssl, alert, etc.)

• Index sizes

Call before a hunt to understand what data is available.

Args: time_from: Start time for dataset counts (dateparser format). time_to: End time for dataset counts.

Quick liveness check of the Malcolm API (GET /mapi/ping).

Export an OpenSearch Dashboards saved object as JSON.

Args: dashboard_id: The dashboard's saved-object id.

Look up asset information from NetBox via Malcolm.

Provides context about what a device/IP is, what role it has, and which network segment it belongs to. Critical for determining whether observed behavior is normal or anomalous.

Args: ip: IP address to look up (e.g. "192.0.2.77"). device: Device name to search (e.g. "switch-01"). prefix: Network prefix to query (e.g. "192.0.2.0/24").

At least one parameter must be provided.

List NetBox sites (the site directory) via Malcolm.

Returns each site's id, name, and metadata. Useful for mapping the physical/logical locations NetBox knows about before drilling into a specific device or prefix.

Search Arkime sessions using Arkime expression syntax.

Arkime expressions are simpler than OpenSearch DSL.

Expression examples: ip==192.0.2.77 ip.src==192.0.2.77 && ip.dst==198.51.100.1 protocols==dns port.dst==443 http.uri==/login* ip==192.0.2.77 && protocols==ssh country.dst==CN

Args: expression: Arkime search expression (required). limit: Maximum sessions to return (1-100). time_from: Start time, epoch seconds. Omit = recent-only; pass a range for historical data. time_to: End time, epoch seconds.

Download and validate the PCAP for one Arkime session.

Fetches the raw PCAP bytes, checks the file-magic (pcap/pcapng), and returns metadata only — nothing is persisted to disk, and the MCP response carries metadata rather than raw bytes. Set url_only=True to get just the download URL for very large sessions (no download).

Args: session_id: Arkime session id (from arkime_sessions results). url_only: If true, return the URL only and skip the download.

Fetch all fields (full SPI document) for one Arkime session.

arkime_sessions returns a trimmed row per session; this returns the complete field set for a single session id.

Args: session_id: Arkime session id (from arkime_sessions results).

List distinct values of one Arkime field, with optional counts.

Lighter than a full aggregation when you only need to see what values a field holds. Returns one value per line (Arkime streams plain text).

Args: field: Arkime field expression, e.g. "ip.dst", "protocols". expression: Optional Arkime filter to scope the values. counts: Include a per-value count (default true).

Top values of one Arkime field, with a time-series graph.

Good for finding top talkers or spotting a value that spikes over time.

Args: field: Arkime field, e.g. "ip.dst", "protocols", "http.host". expression: Optional Arkime filter to scope the data. size: Number of top values to return (1-100). time_from: Start time, epoch seconds. Omit = recent-only. time_to: End time, epoch seconds.

Value profile across several Arkime fields at once.

Returns per-field top values with counts, in a single call — lighter than running one aggregation per field.

Args: spi: Comma-separated fields, each optionally ":", e.g. "protocols:10,ip.dst:20,http.host". expression: Optional Arkime filter to scope the data. time_from: Start time, epoch seconds. Omit = recent-only. time_to: End time, epoch seconds.

Build a source/destination connection graph (who talked to whom).

Returns nodes and links — useful for tracing lateral movement or mapping which hosts a suspect IP communicated with.

Args: src_field: Source field (default "ip.src"). dst_field: Destination field (default "ip.dst:port"). expression: Optional Arkime filter to scope the graph. time_from: Start time, epoch seconds. Omit = recent-only. time_to: End time, epoch seconds.

Find all sessions related to a Zeek UID.

Searches both zeek.uid (direct match) and related.zeek.uid (cross-reference from other log types like files, dns, ssl).

Args: uid: Zeek connection UID (e.g. "CYeji2z7CKmPRGyga"). limit: Maximum related sessions to return.