reverse-skills-max/vendor-new/analyst-ai-pack/skills/generating-capability-reports-with-capa/references/api-reference.md

API Reference: Generating Capability Reports with capa

Overview

scripts/analyst.py summarizes a capa JSON report, aggregating matched rules by ATT&CK technique, MBC behavior, and namespace. It parses an existing report; it does not run capa or the sample.

Dependencies

Package	Version	Purpose
(stdlib)	—	JSON, file IO

External tools

Tool	Purpose
capa	Rule-based capability detection over disassembly (capa -j sample.exe)

Core functions

summarize(report)

Aggregates capa rules into ATT&CK, MBC, and namespace groupings with rule lists/counts.

Usage

capa -j sample.exe > capa.json
python scripts/analyst.py summarize capa.json

Sources

• capa (Mandiant FLARE) — https://github.com/mandiant/capa
• Malware Behavior Catalog (MBC) — https://github.com/MBCProject/mbc-markdown
• capa detects potential capabilities from code patterns and requires unpacked input, per capa documentation