From f90ff8c3c02231442d552f671a6eea7a2a5d3255 Mon Sep 17 00:00:00 2001
From: Matthijs van Polen <matthijs@vanpolen.biz>
Date: Fri, 10 Nov 2023 15:18:48 +0100
Subject: [PATCH] [attack-step] Fixed typo, added multiples.

---
 objects/attack-step/definition.json | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/objects/attack-step/definition.json b/objects/attack-step/definition.json
index ec30a13..7b80a95 100644
--- a/objects/attack-step/definition.json
+++ b/objects/attack-step/definition.json
@@ -26,11 +26,13 @@
       "description": "IP destination of the attack step, if any.",
       "disable_correlation": true,
       "misp-attribute": "ip-dst",
+      "multiple": true,
       "ui-priority": 1
     },
     "dst-misc": {
-      "description": "Other type of source of the attack step, if any. This can be e.g. localhost.",
+      "description": "Other type of destination of the attack step, if any. This can be e.g. localhost.",
       "misp-attribute": "text",
+      "multiple": true,
       "ui-priority": 1
     },
     "expected-response": {
@@ -50,16 +52,19 @@
     "source-domain": {
       "description": "Domain source of the attack step, if any.",
       "misp-attribute": "domain",
+      "multiple": true,
       "ui-priority": 1
     },
     "source-ip": {
       "description": "IP source of the attack step, if any.",
       "misp-attribute": "ip-src",
+      "multiple": true,
       "ui-priority": 1
     },
     "source-misc": {
       "description": "Other type of source of the attack step, if any. This can be e.g. rotating ip from cloud providers such as AWS, or localhost.",
       "misp-attribute": "text",
+      "multiple": true,
       "ui-priority": 1
     },
     "succesful": {