From b7d407e1d0531a03f4d884fa4695d8c55c98a0c4 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 9 Nov 2026 17:30:19 +0100
Subject: [PATCH 1/2] new: [dce-rpc] Add dce-rpc object template

---
 objects/dce-rpc/definition.json | 71 +++++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 objects/dce-rpc/definition.json

diff --git a/objects/dce-rpc/definition.json b/objects/dce-rpc/definition.json
new file mode 100644
index 00000000..17605001
--- /dev/null
+++ b/objects/dce-rpc/definition.json
@@ -0,0 +1,71 @@
+{
+  "attributes": {
+    "ack-reason": {
+      "description": "Source numeric bind acknowledgement reason.",
+      "disable_correlation": true,
+      "misp-attribute": "integer",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "ack-result": {
+      "description": "Source numeric bind acknowledgement result.",
+      "disable_correlation": true,
+      "misp-attribute": "integer",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "command": {
+      "description": "Request command such as REQUEST or BIND.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "flag": {
+      "description": "One source RPC interface flag per attribute.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "interface-uuid": {
+      "description": "UUID identifying the RPC interface or service.",
+      "disable_correlation": true,
+      "misp-attribute": "uuid",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "interface-version": {
+      "description": "Interface version reported for this DCE/RPC interaction.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "operation-number": {
+      "description": "RPC operation number identifying the invoked method within its interface.",
+      "disable_correlation": true,
+      "misp-attribute": "integer",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "response-command": {
+      "description": "Response command such as RESPONSE, BINDACK, or FAULT.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    }
+  },
+  "description": "An observed DCE/RPC operation and its interface identity, including operation number, commands and bind acknowledgement information. Based on OCSF 1.9.0: https://schema.ocsf.io/1.9.0/objects/dce_rpc, https://schema.ocsf.io/1.9.0/objects/rpc_interface.",
+  "meta-category": "network",
+  "name": "dce-rpc",
+  "requiredOneOf": [
+    "interface-uuid",
+    "operation-number",
+    "command"
+  ],
+  "uuid": "dc7970a3-8a28-476e-a767-0649afa3e688",
+  "version": 1
+}
\ No newline at end of file

From 1e35182f77af082c9f3fa65950535129506255e0 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 9 Nov 2026 17:42:27 +0100
Subject: [PATCH 2/2] fix: [dce-rpc] Address Codex review feedback

---
 objects/dce-rpc/definition.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/objects/dce-rpc/definition.json b/objects/dce-rpc/definition.json
index 17605001..da8882a5 100644
--- a/objects/dce-rpc/definition.json
+++ b/objects/dce-rpc/definition.json
@@ -3,14 +3,14 @@
     "ack-reason": {
       "description": "Source numeric bind acknowledgement reason.",
       "disable_correlation": true,
-      "misp-attribute": "integer",
+      "misp-attribute": "counter",
       "to_ids": false,
       "ui-priority": 1
     },
     "ack-result": {
       "description": "Source numeric bind acknowledgement result.",
       "disable_correlation": true,
-      "misp-attribute": "integer",
+      "misp-attribute": "counter",
       "to_ids": false,
       "ui-priority": 1
     },
@@ -46,7 +46,7 @@
     "operation-number": {
       "description": "RPC operation number identifying the invoked method within its interface.",
       "disable_correlation": true,
-      "misp-attribute": "integer",
+      "misp-attribute": "counter",
       "to_ids": false,
       "ui-priority": 1
     },
@@ -67,5 +67,5 @@
     "command"
   ],
   "uuid": "dc7970a3-8a28-476e-a767-0649afa3e688",
-  "version": 1
+  "version": 2
 }
\ No newline at end of file