search

MAECProject / MAECProject.github.io

Landing page for MAEC docs
https://maecproject.github.io
BSD 3-Clause "New" or "Revised" License
20 stars 6 forks source link

tracking info in tool for parser #90

Open vineetabajaj opened 7 years ago

vineetabajaj commented 7 years ago

I am trying to track how a tool run, and maintain its log and giving output in xml. where i can find these parser without using cuckoo, please help me in tracking info so that i can make use of parser for different tool.

ikiril01 commented 7 years ago

Hi @vineetabajaj - can you please provide some clarification about what you're trying to do? Is your goal to output MAEC from other tools (not just Cuckoo), or something else?

vineetabajaj commented 7 years ago

yes this is what i am trying to know how it works ..

On Mon, Mar 27, 2017 at 8:04 PM, Ivan Kirillov notifications@github.com wrote:

Hi @vineetabajaj https://github.com/vineetabajaj - can you please provide some clarification about what you're trying to do? Is your goal to output MAEC from other tools (not just Cuckoo), or something else?

— You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/MAECProject/MAECProject.github.io/issues/90#issuecomment-289472402, or mute the thread https://github.com/notifications/unsubscribe-auth/AY80MdQfCsdJjE6XpB97Eropu7dhl9cGks5rp8jkgaJpZM4Mp1zA .

vineetabajaj commented 7 years ago

yes i want to know how a tool store its output and maintain its log and gives output in xml(maec).

vineetabajaj commented 7 years ago

yes i want to know how a tool used by cuckoo store its output and maintain its log and gives output in xml(maec).

ikiril01 commented 7 years ago

The Cuckoo Sandbox MAEC module [1] parses the Cuckoo results and then uses the python-maec library [2] to generate its output.

[1] https://github.com/cuckoosandbox/cuckoo/blob/5231ff3a455e9c1c36239a025a1f6840029a9ed8/modules/reporting/maec40.py [2] https://github.com/MAECProject/python-maec

Hope this helps, at least as a starting point - if you have any specific questions about either feel free to ask :)