From a38bfdb6e2e645a958f9ca1666fd8b1c02145b94 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 9 Nov 2026 17:33:17 +0100
Subject: [PATCH 1/2] new: [permission-analysis] Add permission-analysis object
 template

---
 objects/permission-analysis/definition.json | 58 +++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 objects/permission-analysis/definition.json

diff --git a/objects/permission-analysis/definition.json b/objects/permission-analysis/definition.json
new file mode 100644
index 00000000..eedc0aab
--- /dev/null
+++ b/objects/permission-analysis/definition.json
@@ -0,0 +1,58 @@
+{
+  "attributes": {
+    "analyzed-privileges-count": {
+      "description": "Number of privileges evaluated by this analysis.",
+      "disable_correlation": true,
+      "misp-attribute": "counter",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "condition": {
+      "description": "One complete policy condition serialized as a JSON name/value or name/values object per attribute, retaining grouping and types.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "potential-attacks-count": {
+      "description": "Number of privilege-to-attack mappings reported by the analyzer; this is not a count of observed attacks.",
+      "disable_correlation": true,
+      "misp-attribute": "counter",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "privilege": {
+      "description": "One granted action or privilege per attribute.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "unused-privileges-count": {
+      "description": "Number of evaluated privileges unused within the source analysis timeframe.",
+      "disable_correlation": true,
+      "misp-attribute": "counter",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "unused-services-count": {
+      "description": "Number of services or resource types not used within the source analysis timeframe.",
+      "disable_correlation": true,
+      "misp-attribute": "counter",
+      "to_ids": false,
+      "ui-priority": 1
+    }
+  },
+  "description": "One identity-centric permission analysis result with granted actions and counts of unused permissions, unused services and potential attack mappings. Based on OCSF 1.9.0: https://schema.ocsf.io/1.9.0/objects/permission_analysis_result.",
+  "meta-category": "misc",
+  "name": "permission-analysis",
+  "requiredOneOf": [
+    "privilege",
+    "analyzed-privileges-count",
+    "unused-privileges-count"
+  ],
+  "uuid": "849d7f31-05cd-43db-b100-4ffe52f8c691",
+  "version": 1
+}
\ No newline at end of file

From b8c504b35913325106fb4318106236eb1f1dfaad Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 9 Nov 2026 17:43:14 +0100
Subject: [PATCH 2/2] fix: [permission-analysis] Address Codex review feedback

---
 objects/permission-analysis/definition.json | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/objects/permission-analysis/definition.json b/objects/permission-analysis/definition.json
index eedc0aab..49ef7278 100644
--- a/objects/permission-analysis/definition.json
+++ b/objects/permission-analysis/definition.json
@@ -51,8 +51,10 @@
   "requiredOneOf": [
     "privilege",
     "analyzed-privileges-count",
-    "unused-privileges-count"
+    "unused-privileges-count",
+    "unused-services-count",
+    "potential-attacks-count"
   ],
   "uuid": "849d7f31-05cd-43db-b100-4ffe52f8c691",
-  "version": 1
+  "version": 2
 }
\ No newline at end of file