From 21fcee20517e1a511c17384cfde83c68e3127116 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 9 Nov 2026 17:34:11 +0100
Subject: [PATCH 1/2] new: [network-interface] Add network-interface object
 template

---
 objects/network-interface/definition.json | 70 +++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 objects/network-interface/definition.json

diff --git a/objects/network-interface/definition.json b/objects/network-interface/definition.json
new file mode 100644
index 00000000..28451832
--- /dev/null
+++ b/objects/network-interface/definition.json
@@ -0,0 +1,70 @@
+{
+  "attributes": {
+    "hostname": {
+      "description": "Hostname associated with the interface.",
+      "disable_correlation": false,
+      "misp-attribute": "hostname",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "interface-id": {
+      "description": "Source identifier of this interface, scoped to its host or provider.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "ip-address": {
+      "description": "Address associated with the interface; the attribute type does not imply traffic direction. Use a separate observation for each address/prefix pair.",
+      "disable_correlation": false,
+      "misp-attribute": "ip-src",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "mac-address": {
+      "description": "Interface hardware address.",
+      "disable_correlation": false,
+      "misp-attribute": "mac-address",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "name": {
+      "description": "Interface name, such as eth0 or a provider-assigned interface label.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "namespace": {
+      "description": "Namespace that distinguishes this interface from similarly named interfaces.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "subnet-prefix": {
+      "description": "Prefix length associated with ip-address, using the correct IPv4 or IPv6 width.",
+      "disable_correlation": true,
+      "misp-attribute": "integer",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "type": {
+      "description": "Interface kind such as Wired, Wireless, Mobile, or Tunnel.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    }
+  },
+  "description": "A physical or virtual network interface with its own identity, namespace and addressing, separate from the host and connections using it. Based on OCSF 1.9.0: https://schema.ocsf.io/1.9.0/objects/network_interface.",
+  "meta-category": "network",
+  "name": "network-interface",
+  "requiredOneOf": [
+    "interface-id",
+    "name",
+    "mac-address"
+  ],
+  "uuid": "6fef748d-a4c5-4b13-8c1e-8dbc1e1f7a92",
+  "version": 1
+}
\ No newline at end of file

From d6a3cf3b8ac26be2a75bc8e9ca29fa84f3cf68b3 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 9 Nov 2026 17:43:26 +0100
Subject: [PATCH 2/2] fix: [network-interface] Address Codex review feedback

---
 objects/network-interface/definition.json | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/objects/network-interface/definition.json b/objects/network-interface/definition.json
index 28451832..3417d41b 100644
--- a/objects/network-interface/definition.json
+++ b/objects/network-interface/definition.json
@@ -45,7 +45,7 @@
     "subnet-prefix": {
       "description": "Prefix length associated with ip-address, using the correct IPv4 or IPv6 width.",
       "disable_correlation": true,
-      "misp-attribute": "integer",
+      "misp-attribute": "counter",
       "to_ids": false,
       "ui-priority": 1
     },
@@ -63,8 +63,10 @@
   "requiredOneOf": [
     "interface-id",
     "name",
-    "mac-address"
+    "mac-address",
+    "ip-address",
+    "hostname"
   ],
   "uuid": "6fef748d-a4c5-4b13-8c1e-8dbc1e1f7a92",
-  "version": 1
+  "version": 2
 }
\ No newline at end of file