Proposal: Deprecate MAEC Container

Status: Open
Comment Period Closes:
Affects Backwards Compatibility: Yes
Relevant Issues: https://github.com/MAECProject/schemas/issues/103

Background Information

The MAEC Container was created to support notional use cases where multiple MAEC Packages needed to be embedded in a single document. However, there are simpler options for supporting multiple MAEC Packages.

Proposal

We propose to deprecate the MAEC Container for the sake of simplicity. The MAEC Container use case is not strong enough to warrant having the separate output format. A simpler alternative is to capture multiple MAEC Packages in a single Package document.

Example

<maecPackage:MAEC_Packages>
  <maecPackage:MAEC_Package id="maec-test-pkg-1" schema_version="5.0">
    <maecPackage:Objects>
    ...
    </maecPackage:Objects>
    <maecPackage:Malware_Subjects>
      ...
    </maecPackage:Malware_Subjects>
  </maecPackage:MAEC_Package>
  <maecPackage:MAEC_Package id="maec-test-pkg-2" schema_version="5.0">
    <maecPackage:Malware_Subjects>
      <maecPackage:Malware_Subject>
      ...
      </maecPackage:Malware_Subject>
    </maecPackage:Malware_Subjects>
  </maecPackage:MAEC_Package>
</maecPackage:MAEC_Packages>

Impact

This change will not be backward compatible.

Requested Feedback

1. Does the proposed deprecation of the MAEC Container make sense?
2. Is the proposed capture of multiple MAEC Packages in a single Package document reasonable?
3. Are there alternative solutions?