mandiant / mandiant/capa

`CapeExtractor` version mismatch warning on self-hosted CAPE reports

Open Beginner friendly
#3,082 2 comments 0 reactions 0 assignees View on GitHub
bug cape
Dominant language
Python
Stars
6.2k
Forks
726
Avg merge
11d 11h
Merged PRs (30d)
7

Description

When running `capa` against a `report.json` generated by a standard self-hosted CAPE Sandbox instance, `capa` logs a version warning:

```log
[capa.features.extractors.cape.extractor] WARNING: CAPE version '2.5' not tested/supported yet
```

### **Root Cause**
In `capa/features/extractors/cape/extractor.py`, `TESTED_VERSIONS` only contains versions with a `"-CAPE"` suffix:
```python
TESTED_VERSIONS = {"2.2-CAPE", "2.4-CAPE", "2.5-CAPE"}
```
* The hosted instance (`capesandbox.com`) writes version strings as `"2.5-CAPE"`.
* Self-hosted open-source CAPE instances write version strings simply as `"2.5"`.

### **Proposed Solution**
Update the version validation in `capa/features/extractors/cape/extractor.py` to support non-suffixed variants:
```python
TESTED_VERSIONS = {
"2.2", "2.2-CAPE",
"2.4", "2.4-CAPE",
"2.5", "2.5-CAPE",
}
```

Contributor guide

Open the contributing guide

Research direction

Start in capa/features/extractors/cape/extractor.py by reading TESTED_VERSIONS and the version-validation path. Update the supported-version entries for the non-suffixed CAPE forms, then verify that a self-hosted report.json with version 2.5 no longer produces the unsupported-version warning.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
reverse-engineering
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.