malcolm_field_search
Search field names in Malcolm's index to verify they exist before querying. Use keyword, prefix, or field type to locate non-standard names like 'http.useragent'.
Instructions
Search available field names in Malcolm's index.
Use this tool BEFORE querying to verify field names exist. Malcolm uses NON-STANDARD field names (e.g. http.useragent, NOT http.user_agent).
Args: keyword: Substring to search in field names (e.g. "useragent", "signature"). prefix: Field name prefix (e.g. "zeek.dns", "suricata.alert", "rule"). field_type: Filter by type (e.g. "keyword", "ip", "long", "date").
At least one parameter should be provided. Results sorted alphabetically.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| prefix | No | ||
| keyword | No | ||
| field_type | No |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |