Read one anomaly detector's top anomalies
malcolm_anomaly_resultsRead-only
Read which entities one anomaly detector scored as anomalous in a time window, worst first, with run state showing whether it ran or found nothing.
Instructions
Read which entities one anomaly detector scored as anomalous in a window, worst first.
Use this after malcolm_anomaly_detectors, which reports a single
anomaly count across every detector and admits it cannot tell "the
detector ran and found nothing" from "the detector was never started".
This asks one named detector for its own results and reports its run
state beside them, which settles that question and names WHICH entity
was anomalous and WHEN. For signature-based detection use malcolm_alerts
(Suricata) or malcolm_alerting_alerts (standing OpenSearch rules); this
is the machine-learning baseline instead.
TIME HERE IS EPOCH MILLISECONDS, unlike every arkime_* tool, which takes
seconds. A seconds-shaped value is rejected rather than forwarded:
upstream it is a window in 1970 that answers empty, indistinguishable
from clean traffic.
Returns JSON {"detector_id", "detector_state", "window", "showing",
"anomalies"}; the shape is in the output schema. Entity buckets are
passed through unrenamed because their keys follow the detector's own
category fields, so they differ per detector. No anomalies comes back as
a sentence that says what the detector's state implies about that
emptiness. Real-time detector results only; historical analysis tasks
are not queried.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | Max entity buckets to return, worst first. | |
| order | No | Rank buckets by "severity" (highest anomaly grade, the default — the single worst entity) or "occurrence" (most anomalous results — the entity that was odd most often). | severity |
| detector_id | Yes | The detector's id, returned as `id` by malcolm_anomaly_detectors (e.g. "ExampleOsDocId000002"). Not its name. | |
| end_time_ms | Yes | Window end in EPOCH MILLISECONDS, greater than start_time_ms. Anomalies are placed by the detection interval they were scored in, so widen the window rather than guessing an offset. | |
| start_time_ms | Yes | Window start in EPOCH MILLISECONDS (not seconds — a seconds value is rejected). Multiply an arkime_* timestamp by 1000. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |