Fetch a Zeek-extracted file
malcolm_extract_fileRead-only
Retrieve metadata for a Zeek-extracted file from Malcolm's server without downloading the bytes, preventing exposure to malware. Ideal after a file scan to verify file integrity via sha256.
Instructions
Fetch one Zeek-extracted file from Malcolm's extracted-files server; returns METADATA ONLY.
Use this after malcolm_file_scans, which supplies the filename. Use
arkime_file_by_hash instead when you hold a content hash but no Zeek
file record, and arkime_session_pcap for a session's packets rather than
one carved file.
The bytes never enter the response and nothing is written to disk — a
carved file may be live malware. The body is streamed against a 100 MB
cap — under Malcolm's own 128 MB extraction ceiling
(EXTRACTED_FILE_MAX_BYTES) — and a larger file is refused before it is
read; url_only=True skips the download without contacting Malcolm at
all.
The returned sha256 is computed over the bytes actually served: compare
it with the malcolm_file_scans row's to see whether the file on disk is
still the one Zeek recorded. A 404 comes back as found:false — the index
record outlives the file, which Malcolm prunes. Any other error status is
reported as a failure, not as a missing file: it says nothing about
whether the file is on disk.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| filename | Yes | The `extracted` value from a malcolm_file_scans row (Zeek's zeek.files.extracted). A full "extracted-files/<name>" URI is accepted too. Names are flat — the extracted-files directory has no subdirectories, so a name carrying a path separator is refused before any request is sent. | |
| url_only | No | If true, return only the download URL and skip the download (use for a file larger than the size cap). |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |