diff --git a/objects/ddos/definition.json b/objects/ddos/definition.json
index 78b014a..0e7cd4c 100644
--- a/objects/ddos/definition.json
+++ b/objects/ddos/definition.json
@@ -4,6 +4,22 @@
   "description": "DDoS object describes a current DDoS activity from a specific or/and to a specific target. Type of DDoS can be attached to the object as a taxonomy",
   "version": 1,
   "attributes": {
+    "total-pps": {
+      "misp-attribute": "counter",
+      "misp-usage-frequency": 0
+    },
+    "last-seen": {
+      "misp-attribute": "datetime",
+      "misp-usage-frequency": 0
+    },
+    "text": {
+      "misp-attribute": "text",
+      "misp-usage-frequency": 0
+    },
+    "total-bps": {
+      "misp-attribute": "counter",
+      "misp-usage-frequency": 0
+    },
     "ip-src": {
       "misp-attribute": "ip-src",
       "misp-usage-frequency": 1,
@@ -39,27 +55,16 @@
     "protocol": {
       "misp-attribute": "text",
       "misp-usage-frequency": 0,
-      "required_value": ["TCP", "UDP", "ICMP", "IP"]
+      "required_value": [
+        "TCP",
+        "UDP",
+        "ICMP",
+        "IP"
+      ]
     },
     "first-seen": {
       "misp-attribute": "datetime",
       "misp-usage-frequency": 0
-    },
-    "last-seen": {
-      "misp-attribute": "datetime",
-      "misp-usage-frequency": 0
-    },
-    "total-pps": {
-      "misp-attribute": "counter",
-      "misp-usage-frequency": 0
-    },
-    "total-bps": {
-      "misp-attribute": "counter",
-      "misp-usage-frequency": 0
-    },
-    "text": {
-      "misp-attribute": "text",
-      "misp-usage-frequency": 0
     }
   },
   "requiredOneOf": [