Sessions
Export PCAP for Multiple Sessions
Returns a PCAP file containing packets from sessions matching the query criteria. The response is a binary PCAP file suitable for analysis with tools like Wireshark.
Not available when scope=demo (returns 403).
get/v3/sessions/export
Query parameters
scope'workspace' | 'demo'
Controls the data scope for the query.
- workspace: Query data from the current workspace (default). Requires the Sensors entitlement.
- demo: Query demo/sample data. Requires the Swarm entitlement. Not available on export endpoints.
start_timestring date-time required
Start time for the query range (ISO 8601 format).
end_timestring date-time required
End time for the query range (ISO 8601 format).
querystring
Lucene query string to filter sessions.
mode'page' | 'all'
Export selection mode.
- page: Export a single page of results (use with page and page_size). This is the default.
- all: Export all sessions matching the query, up to page_size results.
pageinteger
Page number to export when mode=page.
page_sizeinteger
Number of sessions per page when mode=page, or the maximum number of sessions to export when mode=all. The legacy size parameter is accepted as an alias.
sort_bystring
Field to sort results by.
sort_desc'true' | 'false'
Whether to sort in descending order.
Response
PCAP file containing matching session packets.