From cc00814debb1655106cd92716e75d09c1d1d081a Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 9 Nov 2026 17:34:47 +0100
Subject: [PATCH 1/2] new: [data-classification] Add data-classification object
 template

---
 objects/data-classification/definition.json | 112 ++++++++++++++++++++
 1 file changed, 112 insertions(+)
 create mode 100644 objects/data-classification/definition.json

diff --git a/objects/data-classification/definition.json b/objects/data-classification/definition.json
new file mode 100644
index 00000000..5cdd3069
--- /dev/null
+++ b/objects/data-classification/definition.json
@@ -0,0 +1,112 @@
+{
+  "attributes": {
+    "category": {
+      "description": "Source category of discovered data, such as financial or personal information.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "classification-id": {
+      "description": "Identifier of this classification record or definition.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "classifier-id": {
+      "description": "Identifier of the classifier that produced the observation.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "classifier-name": {
+      "description": "Name of the classifier that produced the observation.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "classifier-type": {
+      "description": "Source classifier type.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "confidentiality": {
+      "description": "Source confidentiality label assigned to the data.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "detection-pattern": {
+      "description": "Pattern used by the source to identify the data.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "detection-system": {
+      "description": "Source detection system label.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "lifecycle-state": {
+      "description": "Data lifecycle state in the source DLP observation.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "pattern-match": {
+      "description": "Matched content reported by the source; include only when appropriate for the event's sharing scope.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "reference": {
+      "description": "Source documentation or details URL for the classification.",
+      "disable_correlation": true,
+      "misp-attribute": "link",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "size": {
+      "description": "Size of the classified data in the source's units; OCSF does not specify a unit for this field.",
+      "disable_correlation": true,
+      "misp-attribute": "integer",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "status": {
+      "description": "Observed classification or inspection status.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "to_ids": false,
+      "ui-priority": 1
+    },
+    "total": {
+      "description": "Total number of entities discovered by the classification job.",
+      "disable_correlation": true,
+      "misp-attribute": "counter",
+      "to_ids": false,
+      "ui-priority": 1
+    }
+  },
+  "description": "One data classification or DLP observation, including source category, confidentiality, classifier, lifecycle and detection context. It records source labels without imposing a universal classification vocabulary. Based on OCSF 1.9.0: https://schema.ocsf.io/1.9.0/objects/data_classification, https://schema.ocsf.io/1.9.0/objects/data_security.",
+  "meta-category": "misc",
+  "name": "data-classification",
+  "requiredOneOf": [
+    "category",
+    "confidentiality",
+    "pattern-match"
+  ],
+  "uuid": "3d140214-abf3-46cd-b38a-f5660716e53f",
+  "version": 1
+}
\ No newline at end of file

From fb4761f88c9b41de2db6e0706dada3d7b4ea63d7 Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Mon, 9 Nov 2026 17:43:37 +0100
Subject: [PATCH 2/2] fix: [data-classification] Address Codex review feedback

---
 objects/data-classification/definition.json | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/objects/data-classification/definition.json b/objects/data-classification/definition.json
index 5cdd3069..6c10cc9b 100644
--- a/objects/data-classification/definition.json
+++ b/objects/data-classification/definition.json
@@ -80,7 +80,7 @@
     "size": {
       "description": "Size of the classified data in the source's units; OCSF does not specify a unit for this field.",
       "disable_correlation": true,
-      "misp-attribute": "integer",
+      "misp-attribute": "counter",
       "to_ids": false,
       "ui-priority": 1
     },
@@ -105,8 +105,11 @@
   "requiredOneOf": [
     "category",
     "confidentiality",
-    "pattern-match"
+    "pattern-match",
+    "detection-pattern",
+    "lifecycle-state",
+    "detection-system"
   ],
   "uuid": "3d140214-abf3-46cd-b38a-f5660716e53f",
-  "version": 1
+  "version": 2
 }
\ No newline at end of file