Search Suricata alerts
malcolm_alertsRead-only
Search Suricata IDS alerts by signature, category, IP, severity, or SID without knowing Malcolm field names. Maps your search terms to the correct fields automatically.
Instructions
Search Suricata alerts with structured parameters, no field knowledge needed.
Use this instead of malcolm_search when hunting Suricata alerts: it maps
each argument to the correct Malcolm field for you (you don't need to
know whether it's suricata.alert.signature or rule.name). It always
filters event.dataset=alert. These are Suricata IDS alerts, signature
matches on the wire; three other things on this server are also called
alerts and are different mechanisms — malcolm_alerting_monitors and
malcolm_alerting_alerts are the OpenSearch alerting plugin's standing
rules and their firings, malcolm_anomaly_detectors is its machine-learning
baseline, and malcolm_create_alert (alerting write class) records a
finding of your own.
Behavior: `signature` and `category` are substring searches, which Malcolm
cannot express in a filter (its filters are exact terms), so this tool
resolves the substring against the field's 500 most common values first
and filters on the matches. A substring that matches no recorded value
returns a message saying so rather than an empty result set — that is the
difference between "no such signature here" and "no alerts fired". That
pre-scan is the one place the time range bites: it reads only the last 24
hours, while the alert search itself covers ALL history when time_from is
empty, so on a capture older than a day every signature reads as
unrecorded until you pass time_from.
Returns the raw Malcolm /mapi/document response (matching alert documents).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | Comma-separated Suricata signature IDs, matched on ECS rule.id (Malcolm renames suricata.alert.signature_id to it). | |
| limit | No | Max alerts to return. | |
| action | No | Rule action: "allowed" or "blocked" (Suricata drop/reject). | |
| dest_ip | No | Filter by destination IP. | |
| time_to | No | End time, dateparser format. Empty = now. | |
| category | No | Alert category substring, matched on ECS rule.category (Malcolm normalizes suricata.alert.category to it). | |
| severity | No | Comma-separated severity levels, e.g. "1,2" (1=high, 2=medium, 3=low). | |
| signature | No | Alert signature substring, e.g. "ET MALWARE", "CVE-2024". Matched on ECS rule.name (Malcolm renames suricata.alert.signature to it). | |
| source_ip | No | Filter by source IP. | |
| time_from | No | Start time, dateparser format. Empty searches ALL history, but the signature/category substring pre-scan then sees only the last 24 hours — pass a range when hunting an older signature. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |