reverse-skills-max/vendor-new/analyst-ai-pack/skills/writing-a-malware-analysis-report/references/api-reference.md

API Reference: Writing a Malware Analysis Report

Overview

scripts/analyst.py generates a structured Markdown report skeleton and checks a draft for the required sections, presence of ATT&CK technique IDs, and accidental clickable URLs.

Dependencies

Package	Version	Purpose
(stdlib)	—	Templating, regex, file IO

Core functions

scaffold(sha256, name)

Returns a complete Markdown report template with the standard section order and example tables for identity, capabilities, IOCs, and detection.

check(text)

Returns a list of completeness problems: missing required sections, no ATT&CK IDs, or clickable URLs that should be defanged.

Usage

python scripts/analyst.py scaffold --sha256 <sha256> --name "Sample" > report.md
python scripts/analyst.py check report.md

Sources

• MITRE ATT&CK technique catalog — https://attack.mitre.org/
• MISP core format and STIX 2.1 for structured IOC representation — https://www.misp-project.org/
• Common DFIR reporting structure (executive summary → identity → capabilities → IOCs → detection), standard practice across CERT/IR teams