lib.maec.maec11.APICallType:
APICall_ParameterType is intended provide a method for the
characterization of API calls, namely functions and their
parameters.The apifunction_name attribute contains the exact name
of the API function called.
lib.maec.maec11.APICall_ParameterType:
This attribute refers to the ordinal position of the API function
call parameter with respect to the function itself.
lib.maec.maec11.ActionReferenceType:
ActionReferenceType is intended to serve as a method for linking to
actions.The action_id attribute refers to the ID of the action
being referenced.The type field refers to the type of action entity
that is being referenced.
lib.maec.maec11.ActionType:
ActionType is intended to serve as a method for the
characterization of actions found or observed in malware.
lib.maec.maec11.AnalysisType:
AnalysisType is intended to provide a way of characterizing typical
malware analysis-related metadata, such as the subject of the
analysis and when it was started.The analysis_method attribute is
intended to provide a way of characterizing the type of analysis
method used in the analysis element.
lib.maec.maec11.BehaviorCollectionType:
BehaviorCollectionType is intended to provide a mechanism for
characterizing collections of behaviors.The name attribute contains
the name of the behavior collection, if applicable.
lib.maec.maec11.BehaviorReferenceType:
BehaviorReferenceType is intended to serve as a method for linking
to behaviors.The behavior_id attribute refers to the ID of the
behavior being referenced.The type attribute refers to the type of
behavior entity that is being referenced.
lib.maec.maec11.BehaviorType:
BehaviorType is intended to serve as a method for the
characterization of malicious behaviors found or observed in
malware.
lib.maec.maec11.Block:
Block is a Structured_Text element consisting of one of Text_Title,
Text, Code_Example_Language, or Code followed by another Block
element.
lib.maec.maec11.BundleType:
BundleType is intended to serve as the high-level construct under
which all other MAEC elements reside.
lib.maec.maec11.CPESpecificationType:
CPESpecificationType is a modularized data type intended for
providing a consistent approach to uniquely specifying the identity
of a specific platform using the Common Platform Enumeration (CPE)
naming standard.
lib.maec.maec11.CVEVulnerabilityType:
CVEVulnerabilityType is intended to provide a way of referencing
specific vulnerabilities that malware exploits or attempts to
exploit via a Common Vulnerabilities and Exposures (CPE)
identifier.
lib.maec.maec11.CodeType:
CodeType is intended to provide a way of characterizing segments of
malicious code that is extracted or otherwise retrieved from
malware.The codetype attribute is intended to provide a way of
specifying the type of code being characterized.
lib.maec.maec11.DataType:
DataType is intended to provide a relatively abstract way of
characterizing data segments that may be written/read/transmitted
or otherwise utilized in actions or behaviors.
lib.maec.maec11.DiscoveryMethod:
DiscoveryMethod is intended to provide a mechanism for the
characterization of how actions, behaviors, malicious code, data
segments, and other relevant MAEC entities were discovered.The
tool_id attribute contains the id of the tool used to discovery the
entity (if applicable).The method attribute contains the method
used to discover the entity.
lib.maec.maec11.EffectReferenceType:
EffectReferenceType is intended to serve as a method for linking to
effects.The effect_id attribute refers to the ID of the effect
being referenced.The type attribute refers to the type of effect
entity that is being referenced.
lib.maec.maec11.EffectType:
EffectType is intended to serve as a method for the
characterization of the results of succesfully executed actions and
behaviors.
lib.maec.maec11.HashType:
HashType is intended as a way of chracterizing the outputs of
crytopgrahic hash functions.The type attribute refers to the type
of hash used in the Hash_Value element.
lib.maec.maec11.ObjectReferenceType:
ObjectReferenceType is intended to serve as a method for linking to
objects.The object_id attribute refers to the ID of the object
being referenced.This attribute refers to the type of object entity
being referenced.
lib.maec.maec11.ObjectType:
ObjectType is intended to serve as a method for the
characterization of any entities that actions and behaviors operate
on or are associated with.The object_name attribute specifies the
name of the object, if applicable.The type attribute is intended to
characterize the type of object being characterized in this
element.
lib.maec.maec11.PEDataDirectoryStruct:
PEDataDirectoryStruct is intended as container for the attributes
present in a PE binary's data directory structure.
lib.maec.maec11.PEExportType:
PEExportType is intended as container for the attributes relevant
to PE binary exports.
lib.maec.maec11.PEImportType:
PEImportType is intended as container for the attributes relevant
to PE binary imports.The type attribute refers to the type of
import, with regards to being initially visible or hidden in
relation to PE binary packing.
lib.maec.maec11.PEResourceType:
PEResourceType is intended as container for the attributes relevant
to PE binary resources.The type attribute refers to the type of
data referred to by this resource.
lib.maec.maec11.PESectionHeaderStruct:
PESectionHeaderStruct is intended as container for the attributes
present in a PE binary's section header structure.
lib.maec.maec11.PESectionType:
PESectionType is intended as container for the attributes relevant
to PE binary sections.
lib.maec.maec11.PEStringType:
PEStringType is intended as container for strings extracted from PE
binaries.The address attribute refers to the location of the
specified string in the PE binary.The encoding attribute refers to
the encoding method used for the string extracted from the PE
binary.
lib.maec.maec11.meta_item_metadataType:
The modification-date attribute represents the last time that any
CPE property has been modified.The status attribute contains the
internal NVD status of a CPE.The nvd-id attribute contains the NVD
specific unique identifier for a CPE.
dict:
dict() -> new empty dictionary
dict(mapping) -> new dictionary initialized from a mapping object's
(key, value) pairs
dict(iterable) -> new dictionary initialized as if via:
d = {}
for k, v in iterable:
d[k] = v
dict(**kwargs) -> new dictionary initialized with the name=value pairs
in the keyword argument list.