Find related sessions by UID
malcolm_related_sessionsRead-only
Correlate a Zeek UID across all sessions using direct connection and cross-log references to uncover every linked record.
Instructions
Correlate one Zeek UID across sessions via both direct and cross-reference matches.
Use this to pivot from a single connection UID to everything tied to it: it
queries zeek.uid (the direct connection) and rootId (Malcolm's cross-log link,
carrying references from other log types like files, dns, ssl) in one call.
Zeek UIDs only: to pivot from an Arkime session id use
arkime_session_detail, and for a plain single-field query without the dual
direct/related split use malcolm_search with a zeek.uid filter. This tool
earns its place only where one connection is recorded under two different
keys.
Behavior: runs TWO independent Malcolm searches (one per match kind); `limit`
caps EACH side separately, so up to 2×limit sessions come back total. The two
searches fail independently — a failure on one side does not abort the other;
instead the result carries a `direct_error` or `related_error` string for the
side that failed while still returning the side that succeeded (check for those
keys); both failing is reported as an error, since nothing was correlated.
Neither search is time-filtered — like malcolm_search, both cover all
retained history, so an empty result is a real absence rather than a
window. Returns a JSON object with separate "direct" and "related" hit
lists plus a "summary" count (and per-side error keys only when a side
fails).
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| uid | Yes | Zeek connection UID as it appears in the zeek.uid field, e.g. "CYeji2z7CKmPRGyga". An Arkime session id (the "3@240425-..." form) is a different key and correlates nothing here. | |
| limit | No | Max sessions to return per side (direct and related counted separately). |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |