cuckoobox/cuckoo — pull request #153 by gtback (2013-09-13 17:49:48+00:00)
Title: MAEC 4.0 Reporting Module

We've created a new MAEC reporting module that supports MAEC 4.0.

- It depends on the [python-cybox](https://github.com/CybOXProject/python-cybox) and [python-maec](https://github.com/MAECProject/python-maec) packages, both of which can be installed via pip. There are some other [dependencies](https://github.com/CybOXProject/python-cybox#installation), which we can help add to the Cuckoo documentation as well.

```pip install cybox maec```

- A few comments on the configuration options, which we can/should roll into the file itself, or else into the documentation:

```
--Output modes (set in reporting.conf):
mode = "full": Output fully mapped Actions (see maec40_mappings), including Windows Handle mapped/substituted objects,
along with API call/parameter capture via Action Implementations.
mode = "overview": Output only fully mapped Actions, without any Action Implementations. Default mode.
mode = "api": Output only Actions with Action Implementations, but no mapped components.
--Other configuration parameters:
processtree = "true" | "false". Output captured ProcessTree as part of dynamic analysis MAEC Bundle. Default = "true".
output_handles = "true" | "false". Output the Windows Handles used to construct the Object-Handle mappings as a
separate Object Collection in the dynamic analysis MAEC Bundle. Only applicable
for mode = "full" or mode = "overview". Default = "false".
static = "true" | "false". Output Cuckoo static analysis (PEfile) output as a separate MAEC Bundle in the document.
Default = "true".
strings = "true" | "false". Output Cuckoo strings output as a separate MAEC Bundle in the document. Default = "true".
virustotal = "true" | "false". Output VirusTotal output as a separate MAEC Bundle in the document. Default = "true".
```
- Additionally, the MAEC 1.1 reporting module can probably be taken out, but we haven't done that in this pull request.
- The "Metadata" reporting module is not actually MAEC, but rather [MMDEF](http://standards.ieee.org/develop/indconn/icsg/mmdef.html) and should probably be renamed from `metadata.py` to `mmdef.py` to account for that.
- The code in `/lib/maec/maec11.py` supports both MAEC and MMDEF, so we should probably take the MAEC related code out, leaving only the code that supports MMDEF, and rename that file to `mmdef.py`. If you'd prefer, we can also factor it out into it's own library (like we've done with the `maec` package), to remove it from the cuckoo codebase entirely, leaving just the reporting module, and cleaning up the `lib` folder of all MAEC-related code.

@ikiril01 did most of the work on this.