API

• Field Aggregations
• Document Lookup
• Event Logging
• Fields
• Indices
• Ping
• Version
• Examples

Malcolm provides a REST API that can be used to programatically query some aspects of Malcolm’s status and data. Malcolm’s API is not to be confused with the Viewer API provided by Arkime, although there may be some overlap in functionality.