From cc517d197cfa62b3984b73586aa2609d17375093 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 9 Nov 2026 17:33:43 +0100
Subject: [PATCH 1/2] new: [clipboard-item] Add clipboard-item object template

---
 objects/clipboard-item/definition.json | 41 ++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)
 create mode 100644 objects/clipboard-item/definition.json

diff --git a/objects/clipboard-item/definition.json b/objects/clipboard-item/definition.json
new file mode 100644
index 00000000..7899be75
--- /dev/null
+++ b/objects/clipboard-item/definition.json
@@ -0,0 +1,41 @@
+{
+  "attributes": {
+    "data": {
+      "description": "Clipboard bytes as an attachment; decode the OCSF base64 byte string into attachment data without changing the bytes.",
+      "disable_correlation": true,
+      "misp-attribute": "attachment",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "mime-type": {
+      "description": "MIME type describing this item's content.",
+      "disable_correlation": true,
+      "misp-attribute": "mime-type",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "native-type": {
+      "description": "Operating system clipboard format, for example CF_TEXT or public.utf8-plain-text.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "text": {
+      "description": "Clipboard content decoded as UTF-8 text.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    }
+  },
+  "description": "One captured clipboard item, preserving its text or binary evidence, MIME type and native format for clipboard theft and replacement investigations. Based on OCSF 1.9.0: https://schema.ocsf.io/1.9.0/objects/clipboard_item.",
+  "meta-category": "misc",
+  "name": "clipboard-item",
+  "requiredOneOf": [
+    "text",
+    "data"
+  ],
+  "uuid": "3b271513-0eb0-41de-a277-9402f3d76f40",
+  "version": 1
+}
\ No newline at end of file

From cc1f2453b91c134561e418d7adfc9ca250aa2f0a Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 9 Nov 2026 17:43:48 +0100
Subject: [PATCH 2/2] fix: [clipboard-item] Address Codex review feedback

---
 objects/clipboard-item/definition.json | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/objects/clipboard-item/definition.json b/objects/clipboard-item/definition.json
index 7899be75..33b4ffcc 100644
--- a/objects/clipboard-item/definition.json
+++ b/objects/clipboard-item/definition.json
@@ -32,10 +32,13 @@
   "description": "One captured clipboard item, preserving its text or binary evidence, MIME type and native format for clipboard theft and replacement investigations. Based on OCSF 1.9.0: https://schema.ocsf.io/1.9.0/objects/clipboard_item.",
   "meta-category": "misc",
   "name": "clipboard-item",
+  "required": [
+    "mime-type"
+  ],
   "requiredOneOf": [
     "text",
     "data"
   ],
   "uuid": "3b271513-0eb0-41de-a277-9402f3d76f40",
-  "version": 1
+  "version": 2
 }
\ No newline at end of file