From 11934203fcc280ea3df8e7d9a012a167239e1a5b Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 9 Nov 2026 17:30:01 +0100
Subject: [PATCH 1/2] new: [http-response] Add http-response object template

---
 objects/http-response/definition.json | 73 +++++++++++++++++++++++++++
 1 file changed, 73 insertions(+)
 create mode 100644 objects/http-response/definition.json

diff --git a/objects/http-response/definition.json b/objects/http-response/definition.json
new file mode 100644
index 00000000..a172d66f
--- /dev/null
+++ b/objects/http-response/definition.json
@@ -0,0 +1,73 @@
+{
+  "attributes": {
+    "body-length": {
+      "description": "Actual response body size in bytes, independently of a Content-Length header.",
+      "disable_correlation": true,
+      "misp-attribute": "size-in-bytes",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "content-type": {
+      "description": "Media type of the response body.",
+      "disable_correlation": true,
+      "misp-attribute": "mime-type",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "header": {
+      "description": "One complete HTTP response header per attribute in name: value form; retain duplicate header lines as separate attributes.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "latency-ms": {
+      "description": "Observed HTTP response latency in milliseconds.",
+      "disable_correlation": true,
+      "misp-attribute": "integer",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "length": {
+      "description": "Size of the complete response in bytes.",
+      "disable_correlation": true,
+      "misp-attribute": "size-in-bytes",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "message": {
+      "description": "HTTP status line or reason phrase as recorded by the source.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "status": {
+      "description": "Source response status label, such as OK.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "status-code": {
+      "description": "HTTP status code returned by the server, such as 200 or 404.",
+      "disable_correlation": true,
+      "misp-attribute": "integer",
+      "to_ids": false,
+      "ui-priority": 1
+    }
+  },
+  "description": "One observed HTTP response, including status, headers, sizes and response latency. Relate it to its request and network connection. Based on OCSF 1.9.0: https://schema.ocsf.io/1.9.0/objects/http_response.",
+  "meta-category": "network",
+  "name": "http-response",
+  "requiredOneOf": [
+    "status-code",
+    "header",
+    "content-type",
+    "status",
+    "message"
+  ],
+  "uuid": "b059e3a8-3c9d-4689-962a-7a07e349c966",
+  "version": 1
+}
\ No newline at end of file

From 548d810c94156f2213efde76ffb1595a14511358 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 9 Nov 2026 17:42:14 +0100
Subject: [PATCH 2/2] fix: [http-response] Address Codex review feedback

---
 objects/http-response/definition.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/objects/http-response/definition.json b/objects/http-response/definition.json
index a172d66f..78e15793 100644
--- a/objects/http-response/definition.json
+++ b/objects/http-response/definition.json
@@ -25,7 +25,7 @@
     "latency-ms": {
       "description": "Observed HTTP response latency in milliseconds.",
       "disable_correlation": true,
-      "misp-attribute": "integer",
+      "misp-attribute": "counter",
       "to_ids": false,
       "ui-priority": 1
     },
@@ -69,5 +69,5 @@
     "message"
   ],
   "uuid": "b059e3a8-3c9d-4689-962a-7a07e349c966",
-  "version": 1
+  "version": 2
 }
\ No newline at end of file