---
name: malpedia-ingestion
description: "How to get Fraunhofer FKIE Malpedia data into a pandas DataFrame and Parquet: access, the request, the format, limits, quirks and terms."
---

# Load Malpedia family metadata into pandas and Parquet

Source entry: https://signal-lab-jet.vercel.app/datasets/malpedia
Provider: https://malpedia.caad.fkie.fraunhofer.de/usage/api
Checked against the provider's documentation: 2026-11-01

## Access
- No account or key is needed for the public family-metadata endpoint.
- This skill accesses metadata only and never calls sample-information, raw-sample or ZIP-sample endpoints.

## Request
```bash
curl 'https://malpedia.caad.fkie.fraunhofer.de/api/get/families'
```

## Format
JSON object keyed by family ID; values include UUID, common name, aliases, description, attribution, references, source URLs, notes and update date.

## Load into pandas and Parquet
Needs Python 3 with requests, pandas and pyarrow.
```python
"""Malpedia public family metadata -> pandas -> Parquet. No key."""
import requests
import pandas as pd

URL = "https://malpedia.caad.fkie.fraunhofer.de/api/get/families"
r = requests.get(URL, timeout=120)
r.raise_for_status()
payload = r.json()
rows = []
for family_id, item in payload.items():
    rows.append({
        "family_id": family_id,
        "uuid": item.get("uuid"),
        "common_name": item.get("common_name"),
        "updated": item.get("updated"),
        "description": item.get("description"),
        "alt_names": item.get("alt_names", []),
        "attribution": item.get("attribution", []),
        "urls": item.get("urls", []),
    })
df = pd.DataFrame(rows)
df["updated"] = pd.to_datetime(df["updated"], errors="coerce")
df.to_parquet("malpedia_families.parquet", index=False)
print(len(df), "families", "latest family update", df["updated"].max().date().isoformat())
```
Run by us on 2026-11-01 (python 3.13.5 | pandas 3.1.0 | pyarrow 26.0.0 | requests 2.34.2). Result: 3839 families latest family update 2026-10-30

## Limits
- Rate limit: Not stated.
- Keyless responses contain only public material; account-visible results can differ.
- The family endpoint is a current snapshot rather than a versioned historical export.

## Quirks
- The top-level object is keyed by family ID, so preserve that key explicitly when normalizing rows.
- Aliases, attribution and URLs remain list-valued columns in Parquet, while some descriptions are empty.
- Never substitute any /api/get/sample/... endpoint; raw and ZIP samples are out of scope.

## Terms and attribution
- Website content is CC BY-NC-SA 3.0; retain credits, use it non-commercially and share adaptations under the same terms.
- Treat non-public material as TLP:AMBER unless Malpedia designates or agrees otherwise.
- Terms page: https://malpedia.caad.fkie.fraunhofer.de/usage/tos

## Sources
- https://malpedia.caad.fkie.fraunhofer.de/usage/api: "Provide meta data for all families on Malpedia."
- https://malpedia.caad.fkie.fraunhofer.de/usage/api: "Provide all YARA rules with a version newer than a specific date. Intended for users intending regular automated updates."
- https://malpedia.caad.fkie.fraunhofer.de/usage/tos: "The whole content of the website is released under Creative Common's CC BY-NC-SA 3.0 license."
- https://malpedia.caad.fkie.fraunhofer.de/: "More specifically, you will need an account to access all data (malware samples, non-public YARA rules, ...)."

## Help improve this skill
Missing a source, or see something to improve? Call the MCP tool suggest_source or feedback (or POST /api/suggest or /api/feedback). Reviewed ideas: https://signal-lab-jet.vercel.app/agent-suggestions

Information for educational purposes only. Free tiers, limits and licenses belong to the providers and may change; check the provider's own terms before using the data.