GroupingRelationshipTypeMAEC Package Schema

The GroupingRelationshipType provides a mechanism for specifying the relationship that groups together the Malware Subjects in a Package.

Field Name Type Description
Type0..1 ControlledVocabularyStringType

The Type field specifies the type of relationship that groups the Malware Subjects in the Package.

This field is implemented through the xsi:type controlled vocabulary extension mechanism. The default vocabulary type is GroupingRelationshipTypeVocab-1.0 in the namespace. This type is defined in the maec_default_vocabularies.xsd file or at the URL

Malware_Family_Name0..1 string

The Malware_Family_Name field specifies the name of the malware family referred to by the 'same_malware_family' relationship type.

Malware_Toolkit_Name0..1 string

The Malware_Toolkit_Name field specifies the name of the malware toolkit referred to by the 'same_malware_toolkit' relationship type.

Clustering_Metadata0..1 ClusteringMetadataType

The Clustering_Metadata field specifies any metadata regarding the algorithm and/or methods used for cluster the Malware Subjects in this Package.