ActionListTypeMAEC Bundle Schema

The ActionListType captures a list of Actions.


Field Name Type Description
Action1..n MalwareActionType

The Action field specifies a single Action in the list.

The recommended syntax for Action IDs is a dash-delimited format that starts with the word maec, followed by a unique string, followed by the three letter code 'act', and ending with an integer. The regular expression validating these IDs is: maec-[A-Za-z0-9_\-\.]+-act-[1-9][0-9]*.