diff --git a/honeypot_basic/machinetag.json b/honeypot_basic/machinetag.json
index 27de311..fe2253d 100644
--- a/honeypot_basic/machinetag.json
+++ b/honeypot_basic/machinetag.json
@@ -19,9 +19,9 @@
       "description": "Classifies the measures a honeypot takes to defend against malicious activity spreading from itself."
     },
     {
-      "value": "interaction-level",
-      "expanded": "Interaction Level",
-      "description": "Describes whether the exposed functionality of a honeypot is limited in some way, which is usually the case for honeypots that simulate services."
+      "value": "distribution-appearance",
+      "expanded": "Distribution Appearance",
+      "description": "Describes whether the honeypot system appears to be confined to one system or multiple systems."
     },
     {
       "value": "interaction-level",
@@ -99,6 +99,21 @@
           "description": "No action is taken to limit the intruder’s spread of malicious activity against other systems."
         }
       ]
+    },
+    {
+      "predicate": "distribution-appearance",
+      "entry": [
+        {
+          "value": "distributed",
+          "expanded": "Distributed",
+          "description": "The honeypot is or appears to be composed of multiple systems."
+        },
+        {
+          "value": "stand-alone",
+          "expanded": "Stand-Alone",
+          "description": "The honeypot is or appears to be one system."
+        }
+      ]
     }
   ]
 }