Sessions
Get Session by ID
Returns a single session by its ID, including full session metadata and connection details.
get/v3/sessions/{session_id}
Path parameters
session_idstring required
The unique session identifier.
Query parameters
scope'workspace' | 'demo'
Controls the data scope for the query.
- workspace: Query data from the current workspace (default). Requires the Sensors entitlement.
- demo: Query demo/sample data. Requires the Swarm entitlement. Not available on export endpoints.
Response
OK - request successful.
Example response
{
"_id": "2505-abcdef123456",
"firstPacket": "2025-01-15T10:30:00Z",
"lastPacket": "2025-01-15T10:30:05Z",
"source.ip": "203.0.113.45",
"source.port": 54321,
"destination.ip": "198.51.100.10",
"destination.port": 443,
"source.bytes": 1024,
"source.packets": 10,
"destination.bytes": 2048,
"destination.packets": 8,
"classification": "malicious"
}