Find Dashboards saved objects
malcolm_saved_objectsSearch Malcolm's catalogue of pre-built dashboards, visualizations, and saved searches to find existing analysis before writing queries. Returns matching objects with metadata.
Instructions
Find the dashboards, visualizations and saved searches this Malcolm ships.
Use this to discover what pre-built analysis already exists before
building a query by hand — Malcolm ships over a hundred dashboards, and
one of them usually already covers the protocol you are looking at. This
is catalogue metadata only: for the query behind a saved search or
visualization take its `id` to malcolm_saved_object_detail, and for how
a DASHBOARD is built take its `id` to malcolm_dashboard_export — that
endpoint resolves ids as dashboards only, and answers 200 with an
embedded 404 for a visualization or saved-search id.
This searches the Dashboards catalogue, NOT network traffic: for traffic
use malcolm_search, and for the field names behind a visualization use
malcolm_field_search.
Returns JSON {"total", "showing", "objects"}; field names are in the
output schema, which also records why the panel layout is absent.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max objects to return. | |
| search | No | Match against the object TITLE only, e.g. "DNS", "Zeek*". Wildcards work. Empty = every object of the type. | |
| object_type | No | Which saved-object types to search, comma-separated: dashboard, visualization, search, index-pattern. E.g. "dashboard"; "dashboard,search". Values are trimmed and matched case-insensitively, so "Dashboard, Search" works; anything outside the four is refused with the list of what is allowed. | dashboard |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |