From 40de7d93e0c5f2cb6c503879b1a79adbb888c7aa Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 9 Nov 2026 17:31:17 +0100
Subject: [PATCH 1/2] new: [tls-session] Add tls-session object template

---
 objects/tls-session/definition.json | 88 +++++++++++++++++++++++++++++
 1 file changed, 88 insertions(+)
 create mode 100644 objects/tls-session/definition.json

diff --git a/objects/tls-session/definition.json b/objects/tls-session/definition.json
new file mode 100644
index 00000000..91e49bac
--- /dev/null
+++ b/objects/tls-session/definition.json
@@ -0,0 +1,88 @@
+{
+  "attributes": {
+    "alert": {
+      "description": "TLS alert code observed by the source.",
+      "disable_correlation": true,
+      "misp-attribute": "integer",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "cipher": {
+      "description": "Negotiated cipher suite.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "client-cipher": {
+      "description": "One client-advertised cipher suite per attribute.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "handshake-duration-ms": {
+      "description": "Handshake duration in milliseconds after TCP establishment, including source-observed client delays.",
+      "disable_correlation": true,
+      "misp-attribute": "integer",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "ja3": {
+      "description": "Client JA3 MD5 fingerprint; populate only when the source fingerprint algorithm is MD5.",
+      "disable_correlation": false,
+      "misp-attribute": "ja3-fingerprint-md5",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "ja3s": {
+      "description": "Server JA3S MD5 fingerprint; populate only when the source fingerprint algorithm is MD5.",
+      "disable_correlation": false,
+      "misp-attribute": "ja3-fingerprint-md5",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "key-length": {
+      "description": "Negotiated encryption key length in bits.",
+      "disable_correlation": true,
+      "misp-attribute": "integer",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "server-cipher": {
+      "description": "One server-advertised cipher suite per attribute.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "server-name": {
+      "description": "SNI hostname sent by the client; omit this typed field when the source value is not a hostname.",
+      "disable_correlation": false,
+      "misp-attribute": "hostname",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "version": {
+      "description": "Negotiated TLS protocol version.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    }
+  },
+  "description": "Negotiated TLS session properties, including protocol, cipher, server name and handshake observations. Reference certificates and network flows separately. Based on OCSF 1.9.0: https://schema.ocsf.io/1.9.0/objects/tls.",
+  "meta-category": "network",
+  "name": "tls-session",
+  "requiredOneOf": [
+    "version",
+    "cipher",
+    "server-name",
+    "ja3",
+    "ja3s"
+  ],
+  "uuid": "7de2fca6-f67f-44bf-94e9-3b355074f232",
+  "version": 1
+}
\ No newline at end of file

From e286f333456132fdeb3a9fb07c1809f462fe2dec Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 9 Nov 2026 17:42:40 +0100
Subject: [PATCH 2/2] fix: [tls-session] Address Codex review feedback

---
 objects/tls-session/definition.json | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/objects/tls-session/definition.json b/objects/tls-session/definition.json
index 91e49bac..fe42705e 100644
--- a/objects/tls-session/definition.json
+++ b/objects/tls-session/definition.json
@@ -3,7 +3,7 @@
     "alert": {
       "description": "TLS alert code observed by the source.",
       "disable_correlation": true,
-      "misp-attribute": "integer",
+      "misp-attribute": "counter",
       "to_ids": false,
       "ui-priority": 1
     },
@@ -25,7 +25,7 @@
     "handshake-duration-ms": {
       "description": "Handshake duration in milliseconds after TCP establishment, including source-observed client delays.",
       "disable_correlation": true,
-      "misp-attribute": "integer",
+      "misp-attribute": "counter",
       "to_ids": false,
       "ui-priority": 1
     },
@@ -46,7 +46,7 @@
     "key-length": {
       "description": "Negotiated encryption key length in bits.",
       "disable_correlation": true,
-      "misp-attribute": "integer",
+      "misp-attribute": "counter",
       "to_ids": false,
       "ui-priority": 1
     },
@@ -80,9 +80,14 @@
     "version",
     "cipher",
     "server-name",
+    "key-length",
+    "alert",
+    "handshake-duration-ms",
+    "client-cipher",
+    "server-cipher",
     "ja3",
     "ja3s"
   ],
   "uuid": "7de2fca6-f67f-44bf-94e9-3b355074f232",
-  "version": 1
+  "version": 2
 }
\ No newline at end of file