From e0d30596f65abf41f519f9f46702c9fcfeb6b2cf Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Wed, 9 Mar 2022 10:48:47 +0100
Subject: [PATCH] chg: [ddos]  The minimum amount of backscatter received in 5
 minutes / day added in the object as backscatter-threshold.

---
 objects/ddos/definition.json | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/objects/ddos/definition.json b/objects/ddos/definition.json
index 1944d61..ee007f7 100644
--- a/objects/ddos/definition.json
+++ b/objects/ddos/definition.json
@@ -1,5 +1,11 @@
 {
   "attributes": {
+    "backscatter-threshold": {
+      "description": "The minimum amount of backscatter received in 5 minutes / day. This field is only used when the capture origin is indirect network capture such as backscatter.",
+      "disable_correlation": true,
+      "misp-attribute": "counter",
+      "ui-priority": 0
+    },
     "capture-origin": {
       "description": "Origin of the (D)DoS evidences",
       "disable_correlation": true,
@@ -153,5 +159,5 @@
     "domain-dst"
   ],
   "uuid": "e2f124d6-f57c-4f93-99e6-8450545fa05d",
-  "version": 8
-}
\ No newline at end of file
+  "version": 9
+}