Search extracted files and scan verdicts
malcolm_file_scansRead-only
List files seen on the wire with hashes and scan verdicts, filter by hash, MIME type, or executables, and pivot from hashes to related transfer records.
Instructions
List the files Zeek saw cross the wire, with their hashes and scan verdicts.
Use this for any file-centric question — it filters event.dataset=files
for you and returns one compact row per file instead of the multi-KB raw
document. Use malcolm_search instead for any other record type (conn,
dns, http); search_dsl for a substring or wildcard filename match, which
Malcolm's exact-match filters cannot express; arkime_file_by_hash to
pull bytes by a hash Arkime recorded on a session rather than by Zeek's
file record.
Both record types Malcolm files under this dataset are returned, so one
file can come back as two rows: Zeek's record of the transfer, and
Strelka's scan verdict, which is the only row `scan_hits` appears on —
0 there means Strelka scanned the file and matched nothing. A row's
`extracted` value is the argument malcolm_extract_file takes; a row
carrying `note` instead was seen on the wire but is not on disk.
`source_ip` and `destination_ip` are the connection's originator and
responder, so a download reads client to server. The file went from
`sender_ip` to `receiver_ip`, which appear when Zeek recorded the
direction.
No match returns a sentence saying so, naming the field if a filter used
one Malcolm does not index, rather than an empty list. Field names are
in the output schema.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max file records to return. | |
| filters | No | Extra JSON filters in Malcolm filter syntax (see malcolm_search), merged on top of this tool's own. E.g. {"source.ip":"192.0.2.7"}; {"network.protocol":"smb"}. Values are matched EXACTLY — no wildcards. | {} |
| time_to | No | End time, dateparser format. Empty = now. | |
| file_hash | No | Pivot from a hash IOC to the file records carrying it. Matched on related.hash, which holds md5, sha1, sha256, ssdeep and tlsh together, so any of those works, in either case (a tlsh is stored uppercase by Zeek and lowercase by Strelka; both are searched). One file usually has many records — one per session that carried it, plus a scan record — and they can exceed limit; add {"event.dataset":"strelka"} to filters to see the scan verdict on its own. Empty = no hash filter. | |
| mime_type | No | Exact file.mime_type value, or several comma-separated (OR). E.g. "application/x-dosexec"; "image/png,image/jpeg". Note Malcolm records PE executables as application/x-dosexec, not application/x-msdownload. Overrides executables_only when both are given. Empty = any type. | |
| time_from | No | Start time, dateparser format ("2024-01-01", "7 days ago"). Empty = ALL history. | |
| executables_only | No | Shortcut for the eight MIME labels that mean a native executable — PE, ELF (including the x-sharedlib every PIE binary gets), and Mach-O — in both the Zeek and the Strelka vocabulary. Use when hunting dropped binaries. A deployment can still use a label outside that set; if this returns nothing, check malcolm_field_values(field="file.mime_type"). |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |