The PackageType is the namesake type of the MAEC Package schema, and captures either a single Malware Subject, or a collection of Malware Subjects that are related in some way (even if exact details of the relationship are unknown). Unlike the MAEC Bundle, which captures only the MAEC-characterized analysis results for a malware instance, the Package permits the capture of additional metadata relating to the analysis, relationships between Malware Subjects, and similar types of entities.
| Field Name | Type | Description |
|---|---|---|
| @idrequired | QName |
The required id field specifies a unique ID for this Package. |
| @schema_versionrequired | string |
The required schema_version field specifies the version of the MAEC Package schema that the document has been written in and that should be used for validation. |
| @timestampoptional | dateTime |
The timestamp field specifies the date/time that the Package was generated. |
| Malware_Subjects1..1 | MalwareSubjectListType |
The Malware_Subjects field captures each of the Malware Subjects contained in the Package. |
| Grouping_Relationships0..1 | GroupingRelationshipListType |
The Grouping_Relationships field specifies the particular relationships that serve to group the Malware Subjects encompassed in this Package. This is solely for cases where more than one Malware Subject is contained within the Package. |
