[adulau]

Negotiated TLS session properties, including protocol, cipher, server name and handshake observations. Reference certificates and network flows separately.

x509 describes a certificate, while ja3 and ja3s describe fingerprints; none preserves the negotiated protocol, cipher, handshake duration and alert together.

Existing templates considered: x509, ja3, ja3s, network-connection.

Use related-to references to x509, ja4-plus and network-connection objects. Certificate serial numbers alone do not identify certificates across issuers.

OCSF mapping

• tls in OCSF 1.9.0 (versioned source)

MISP object relation	OCSF source path
version	tls.version
cipher	tls.cipher
server-name	tls.sni
key-length	tls.key_length
alert	tls.alert
handshake-duration-ms	tls.handshake_dur
client-cipher	tls.client_ciphers
server-cipher	tls.server_ciphers
ja3	tls.ja3_hash
ja3s	tls.ja3s_hash

Datetime relations use ISO 8601. Importers can prefer the OCSF _time_dt sibling, or convert the corresponding _time epoch milliseconds to a UTC datetime. Unreported booleans remain absent. Source codes, identifiers and strings keep their source meaning; this template is a CTI-oriented subset of the OCSF object.

All attributes default to to_ids: false. Descriptive metadata, local identifiers, counts, flags and timestamps disable correlation; typed network indicators, package URIs and hashes retain correlation where applicable. Nested entities use MISP object references. Source arrays are marked multiple only when their entries can be represented independently.

Example values

These are object-relation/value pairs for one object, with illustrative identifiers:

{
  "version": "TLSv1.3",
  "cipher": "TLS_AES_128_GCM_SHA256",
  "server-name": "example.org"
}

Validation

• ./jq_all_the_things.sh and ./validate_all.sh passed on the baseline plus all 29 proposed templates: 483 template definitions, relationship checks, 22 unit tests and unique UUID checks.
• This template passed JSON Schema validation, required-field reference checks and exact jq -S -j formatting checks against the same baseline.
• The example loaded and serialized with PyMISP 3.0.0 in strict mode.

This PR adds one version-2 template with a fresh UUID, based directly on main at a9c09f216032bc6093d09f68c743cda2dae29aac. It is part of a review of all 190 base OCSF 1.9.0 objects, compared with the 454 existing MISP templates. The review identified 29 new template proposals; existing-template extensions are recorded separately for future work. No live MISP server round-trip was performed.

Codex review updates

• Accept alert-only, cipher-offer-only and timing-only handshake observations before negotiation succeeds.
• Use counter for key-length so the MISP server accepts the valid value zero while preserving whole-number semantics.
• Use counter for alert so the MISP server accepts the valid value zero while preserving whole-number semantics.
• Use counter for handshake-duration-ms so the MISP server accepts the valid value zero while preserving whole-number semantics.

Validation after the fixes: all 29 original examples and 20 regression examples passed with PyMISP 3.0.0 in strict mode; 69 regression checks passed against the unmodified MISP 2.5 PHP attribute validator, including zero/nonzero values, negative rejection and NetBIOS authorities. The complete repository validation suite was rerun on all 483 template definitions.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T16:33:43.345262Z	40de7d9	PR opened
🔒 Security Review	✅ Completed 2026-11-09T16:34:18.619964Z	40de7d9	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 40de7d93e0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".