From f02af5072598aab3cd33d098aa76b7e99fdd0a5d Mon Sep 17 00:00:00 2001
From: Alexandre Dulaunoy <a@foo.be>
Date: Wed, 6 Dec 2023 09:50:54 +0100
Subject: [PATCH] chg: [shadowserver-malware-url-report] sane_default added

---
 objects/shadowserver-malware-url-report/definition.json | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/objects/shadowserver-malware-url-report/definition.json b/objects/shadowserver-malware-url-report/definition.json
index d2f88d2..28c8a3b 100644
--- a/objects/shadowserver-malware-url-report/definition.json
+++ b/objects/shadowserver-malware-url-report/definition.json
@@ -4,6 +4,12 @@
       "description": "Application layer protocol where occurrence of the URL was observed. Examples: http, https, ssh, telnet. ",
       "disable_correlation": true,
       "misp-attribute": "text",
+      "sane_default": [
+        "http",
+        "https",
+        "ssh",
+        "telnet"
+      ],
       "ui-priority": 0
     },
     "asn": {
@@ -105,5 +111,5 @@
     "url"
   ],
   "uuid": "0211496c-dbcf-465b-a147-3d965da016cc",
-  "version": 3
+  "version": 4
 }
\ No newline at end of file