Search Suricata alerts
malcolm_alertsRead-only
Search Suricata IDS alerts using structured parameters that map to correct Malcolm fields, eliminating field-name lookup. Always filters event.dataset=alert.
Instructions
Search Suricata alerts with structured parameters, no field knowledge needed.
Use this instead of malcolm_search when hunting Suricata alerts: it maps
each argument to the correct Malcolm field for you (you don't need to
know whether it's suricata.alert.signature or rule.name). It always
filters event.dataset=alert. These are Suricata IDS alerts, signature
matches on the wire; three other things on this server are also called
alerts and are different mechanisms — malcolm_alerting_monitors and
malcolm_alerting_alerts are the OpenSearch alerting plugin's standing
rules and their firings, malcolm_anomaly_detectors is its machine-learning
baseline, and malcolm_create_alert (alerting write class) records a
finding of your own.
Behavior: `signature` and `category` are substring searches, which Malcolm
cannot express in a filter (its filters are exact terms), so this tool
resolves the substring against the field's 500 most common values first
and filters on the matches. A substring that matches no recorded value
returns a message saying so rather than an empty result set — that is the
difference between "no such signature here" and "no alerts fired". When
more than 500 values exist in the window, the message says how many alert
documents carry the values that were not scanned instead of asserting
absence; narrow the window, or filter rule.name on the exact name with
malcolm_search. When the substring did match but rarer values went
unscanned, a "Note:" line precedes the JSON saying how many alert
documents those values carry. Another "Note:" line says when the alerts
filled limit, since Malcolm reports no total.
Returns {"showing": N, "alerts": [...]}, one row per alert with its
document id, time, rule name, id and category, Suricata severity and
action, both endpoints, transport, protocol and community_id (the key
that finds the same flow in Zeek's conn records through malcolm_search).
Set full=true for the raw documents, which carry every field.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sid | No | Comma-separated Suricata signature IDs, matched on ECS rule.id (Malcolm renames suricata.alert.signature_id to it). | |
| full | No | Return the raw alert documents (about 2 KB each) instead of one compact row per alert. | |
| limit | No | Max alerts to return. | |
| action | No | Rule action: "allowed" or "blocked" (Suricata drop/reject). | |
| dest_ip | No | Filter by destination IP. | |
| time_to | No | End time, dateparser format. Empty = now. | |
| category | No | Alert category substring, matched on ECS rule.category (Malcolm normalizes suricata.alert.category to it). | |
| severity | No | Comma-separated severity levels, e.g. "1,2" (1=high, 2=medium, 3=low). | |
| signature | No | Alert signature substring, e.g. "ET MALWARE", "CVE-2024". Matched on ECS rule.name (Malcolm renames suricata.alert.signature to it). | |
| source_ip | No | Filter by source IP. | |
| time_from | No | Start time, dateparser format. Empty searches ALL history, and the signature/category substring pre-scan covers the same window. |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |