maecproject/maecproject.github.io

Landing page for MAEC docs

maecproject.github.io

This repository is used to build http://maecproject.github.io. If you're looking for documentation about MAEC, you should head over there now, or go straight to the Getting Started page.

Work in progress: The MAEC documentation is still a work in progress.

If you're looking for information about editing the content on the site, you're in the right place!

Installation

1. Install Ruby 1.9.3 or higher for your platform (if it isn't already installed).
2. Install the bundler gem: gem install bundler
3. Install the dependencies via bundler: bundle install
4. Run the server with jekyll server or a static build with jekyll build

Note: Jekyll has some "issues" on Windows. See: Jekyll on Windows for instructions. The issues I encountered (other than those covered in those instructions) were:

• You'll need to install jekyll version 2.3.0:

gem uninstall jekyll # If you already installed it
gem install jekyll --version "=2.3.0"

• You'll need to install pygments version 0.5.0:

gem uninstall pygments.rb
gem install pygments.rb --version "=0.5.0"

If you run into any problems on other platforms, see the Jekyll Installation Docs. In particular, you'll need to be able to compile native code so on OS X you'll need the Xcode Command Line tools and on Linux you'll need the appropriate build packages (build-essential on Ubuntu, etc). As with most other MAEC projects, you'll also need the libxml development libraries installed.

Contributing

The MAEC Project welcomes contributions to our documentation repository. If you have a change you want to make:

1. Fork this repository
2. Create your feature branch (git checkout -b my-new-feature)
3. Commit your changes (git commit -am 'Add some feature')
4. Push to the branch (git push origin my-new-feature)
5. Create new Pull Request

You can also speak to the MAEC team by e-mailing [email protected] and we can make the change for you.

maecproject.github.io's Issues

The content of the MAEC Suggested Practices should be reviewed for applicability to MAEC.

There appears to be content which may not be applicable to MAEC in its current context.

github.io setup

@ikiril01 looks like @bschmoker created the initial setup a few months ago.

Additional Idioms

We could probably add a few more Idioms to our current set:

• Capturing Manual Analysis Results (including use of Capabilities, etc.)
• Capturing Related Sets of Malware (including use of Grouping Relationships, etc.)

List out multiple vocabularies for applicable fields

In our schemas, we have fields where multiple vocabularies are applicable. We should update our data model pages so that these can be listed out and presented to the user; otherwise, its unclear that these vocabularies are.

typo

There is a typo in section 5.5.2 (page 72) of this file:

https://maecproject.github.io/releases/5.0/MAEC_Core_Specification.pdf

The "Malware Action" should be "Malware Instance".

tracking info in tool for parser

I am trying to track how a tool run, and maintain its log and giving output in xml.
where i can find these parser without using cuckoo, please help me in tracking info so that i can make use of parser for different tool.

Should STIX references within the content of Suggested Practices, Assigning IDs point to MAEC data models?

The references to the applicable STIX page are broken; however, should these reference MAEC Data Models: Bundle, Package, etc.?