arkime_sessions_csv
Export sessions as a compact CSV table — about half the tokens of the same rows as JSON
How to use it
Project documentation lists arkime_sessions_csv for the MCP Server Malcolm MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.
Install MCP Server Malcolm
mcp-server-malcolmOther tools in MCP Server Malcolm (39)
Compile an Arkime expression into the OpenSearch DSL it becomes, without running it — hand the result to searchdsl for a clause Arkime's syntax can't express
Source/destination connection graph (nodes and links)
List Arkime's cron queries — saved expressions that re-run on a schedule and explain where an unrecognized session tag came from
Search the field names Arkime expressions accept (listed again under Arkime)
Extract the transferred file whose md5/sha256 matches (metadata only, nothing written to disk)
List Arkime hunt jobs and their progress — queued, running or finished. Not gated by a write class: it only reads job status, so it stays available with every write class off (it is part of the arkime-inventory read group)
Unique value combinations across several fields (e.g. src.ip + dst.port pairs)
Capture-node health: dropped packets, disk, memory, queues — warns when a node is losing packets, since that turns a gap into what looks like an absence
List the PCAP files Arkime has indexed, with each file's size, packet/session counts and time span
Reverse-resolve one IP to its PTR hostname
Fetch all fields (full SPI document) for one session
Fetch the file ONE named session carried, by md5/sha256 (metadata only, nothing written to disk) — pins the answer to that session, unlike arkimefilebyhash, which serves the most recent match across every session
Read a session's decoded payload — the bytes that crossed the wire, not parsed fields (plain text, not JSON)
Fetch a session's PCAP and report its size and file-magic validity (metadata only, nothing written to disk)
Search Arkime sessions with Arkime expression syntax
Total sessions, bytes and packets for an expression, plus per-field breakdowns — size a match before something expensive (like a hunt) acts on it
List named value lists (IOC sets) and what each holds, plus the $name token to use in an expression
Top values of one field with a time-series graph
Hierarchical top-N breakdown across fields (nested drill-down)
Value profile across several fields in one call
List distinct values of one field, with optional counts
List the saved search views the team curated, with each one's expression
OpenSearch cluster health
Count documents matching a DSL query clause
Field mapping/schema for an index
List indices (name/health/status/doc count)
Aggregate traffic by one or more fields (top-N with counts)
Search Suricata alerts by signature, severity, IP
Data freshness per sensor, doc counts per dataset, index info
Show which event.dataset types contain a field
Search available field names by keyword, prefix, or type
List distinct values for a field
Look up an IP, device, or network prefix in NetBox
Read any other NetBox endpoint (services, VLANs, interfaces, VMs, contacts)
List the NetBox site directory (id, name, metadata)
Quick liveness check of the Malcolm API
Search network traffic with Malcolm filter syntax
Readiness of all Malcolm services plus version info
Run a raw OpenSearch DSL query (hits + aggregations, no hidden time window)