Sessions
Get Sessions
Returns a paginated list of network sessions matching the query criteria. Sessions represent individual network connections captured by GreyNoise sensors.
get/v3/sessions
Query parameters
scope'workspace' | 'demo'
Controls the data scope for the query.
- workspace: Query data from the current workspace (default). Requires the Sensors entitlement.
- demo: Query demo/sample data. Requires the Swarm entitlement. Not available on export endpoints.
start_timestring date-time required
Start time for the query range (ISO 8601 format).
end_timestring date-time required
End time for the query range (ISO 8601 format).
querystring
Lucene query string to filter sessions.
pageinteger
Page number for pagination.
page_sizeinteger
Number of results per page.
sort_bystring
Field to sort results by.
sort_desc'true' | 'false'
Whether to sort in descending order.
Response
OK - request successful.
Example response
{
"sessions": [
{
"_id": "2505-abcdef123456",
"firstPacket": "2025-01-15T10:30:00Z",
"lastPacket": "2025-01-15T10:30:05Z",
"source.ip": "203.0.113.45",
"source.port": 54321,
"destination.ip": "198.51.100.10",
"destination.port": 443,
"source.bytes": 1024,
"source.packets": 10,
"destination.bytes": 2048,
"destination.packets": 8,
"classification": "malicious"
}
],
"total": 150,
"pagination": {
"page": 1,
"page_size": 25,
"sort_by": "lastPacket",
"sort_desc": true
},
"request_metadata": {
"start_time": "2025-01-01T00:00:00Z",
"end_time": "2025-01-07T23:59:59Z"
}
}