diff --git a/objects/ddos/definition.json b/objects/ddos/definition.json
index 55c7f7e..78b014a 100644
--- a/objects/ddos/definition.json
+++ b/objects/ddos/definition.json
@@ -38,7 +38,8 @@
     },
     "protocol": {
       "misp-attribute": "text",
-      "misp-usage-frequency": 0
+      "misp-usage-frequency": 0,
+      "required_value": ["TCP", "UDP", "ICMP", "IP"]
     },
     "first-seen": {
       "misp-attribute": "datetime",