MAEC Python Library

4.1.0.17 verified Fri May 01 auth: no python

An API for parsing and creating MAEC (Malware Attribute Enumeration and Characterization) content. Latest version 4.1.0.17. Release cadence is irregular, tied to MAEC updates.

pip install maec

Common errors

error ImportError: cannot import name 'MAEC' from 'maec' ↓

cause Incorrect import path or outdated installation.

fix

Use 'from maec import MAEC' or reinstall the package: pip install --upgrade maec

error AttributeError: 'NoneType' object has no attribute 'to_xml' ↓

cause Attempting to serialize an empty MAEC object without adding any packages.

fix

Ensure at least one Package is added to the MAEC object before calling to_xml().

error lxml.etree.XMLSyntaxError: Document is empty, line 1, column 1 ↓

cause Passing an empty or non-XML string to parsing functions.

fix

Verify the input XML is valid and non-empty. Wrap in try/except to catch parsing errors.

error KeyError: 'maec' not found in namespace map ↓

cause Using pre-4.0 binding code with a 4.x installation.

fix

Update to use the new API: from maec import MAEC; use high-level classes instead of bindings.

Warnings

breaking maec 4.x uses MAEC v4.1 schema; incompatible with MAEC v3.x data. Cannot load older MAEC documents without conversion. ↓

fix Convert MAEC 3.x documents to 4.1 format using provided migration scripts or manually update XML.

deprecated The 'maec.bindings' module is deprecated. Direct binding manipulation is discouraged; use the high-level API instead. ↓

fix Replace binding code with API calls: e.g., use Package() instead of binding.PackageType().

gotcha Missing CybOX dependency: maec requires cybox library. Installation via pip does not automatically install cybox on all systems. ↓

fix Run: pip install cybox

gotcha LXML version compatibility: maec 4.1.0.17 may fail with lxml >= 5.0 due to API changes. Pin lxml<5.0 if errors occur. ↓

fix pip install 'lxml<5.0'

Imports

MAEC
```
from maec import MAEC
```
Package
wrong
```
import maec.Package
```
correct
```
from maec.package import Package
```
Package is in the maec.package module

MalwareSubject

wrong

from maec import MalwareSubject

correct

from maec.malware_subject import MalwareSubject

MalwareSubject is a separate module

Quickstart

Create a minimal MAEC document with a package.

from maec import MAEC
from maec.package import Package

maec = MAEC()
pkg = Package()
maec.add_package(pkg)
print(maec.to_xml())