From 847a2e302e07c06e9564b3a57ad32240e6bc4e8c Mon Sep 17 00:00:00 2001
From: Haroon Arshad <haroonarshad1307@gmail.com>
Date: Fri, 16 Oct 2026 16:56:32 +0500
Subject: [PATCH] Add prompt-injection-observation object

---
 .../definition.json                           | 101 ++++++++++++++++++
 1 file changed, 101 insertions(+)
 create mode 100644 objects/prompt-injection-observation/definition.json

diff --git a/objects/prompt-injection-observation/definition.json b/objects/prompt-injection-observation/definition.json
new file mode 100644
index 00000000..6673a584
--- /dev/null
+++ b/objects/prompt-injection-observation/definition.json
@@ -0,0 +1,101 @@
+{
+  "attributes": {
+    "comment": {
+      "description": "Comment associated to the prompt injection observation.",
+      "misp-attribute": "text",
+      "ui-priority": 12
+    },
+    "deployment-context": {
+      "description": "Type of AI application that was targeted by the injection attempt.",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 7,
+      "values_list": [
+        "customer-chatbot",
+        "code-assistant",
+        "search-assistant",
+        "document-summarizer",
+        "agent-with-tools",
+        "other"
+      ]
+    },
+    "detection-method": {
+      "description": "How the injection attempt was detected or observed.",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 6
+    },
+    "first-seen": {
+      "description": "First time the injection attempt was observed.",
+      "misp-attribute": "datetime",
+      "ui-priority": 10
+    },
+    "last-seen": {
+      "description": "Last time the injection attempt was observed.",
+      "misp-attribute": "datetime",
+      "ui-priority": 11
+    },
+    "mitigation": {
+      "description": "Mitigation or defensive measure applied against this injection technique.",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 8
+    },
+    "model-response": {
+      "description": "Summary or excerpt of the model's response to the injection attempt.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 5
+    },
+    "prompt-text": {
+      "description": "The observed malicious prompt text (as entered or generated by the attacker).",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "ui-priority": 1
+    },
+    "reference": {
+      "description": "External reference (write-up, report, or advisory) documenting this injection technique or campaign.",
+      "misp-attribute": "link",
+      "multiple": true,
+      "ui-priority": 9
+    },
+    "successful": {
+      "description": "True if the injection attempt succeeded (the model followed the injected instructions), false otherwise.",
+      "disable_correlation": true,
+      "misp-attribute": "boolean",
+      "ui-priority": 4
+    },
+    "target-model": {
+      "description": "AI model targeted by the injection attempt.",
+      "disable_correlation": true,
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 3
+    },
+    "technique": {
+      "description": "Prompt injection technique used by the attacker.",
+      "misp-attribute": "text",
+      "multiple": true,
+      "ui-priority": 2,
+      "values_list": [
+        "instruction-override",
+        "roleplay",
+        "encoding-obfuscation",
+        "multi-turn-escalation",
+        "indirect-injection",
+        "delimiter-escape",
+        "tool-use-hijack",
+        "data-exfiltration-prompt",
+        "unknown"
+      ]
+    }
+  },
+  "description": "Object describing an observed prompt injection or jailbreak attempt against an AI system.",
+  "meta-category": "detection",
+  "name": "prompt-injection-observation",
+  "requiredOneOf": [
+    "prompt-text"
+  ],
+  "uuid": "2e7de182-3f86-4105-beb7-b6b0c03484a7",
+  "version": 1
+}
\ No newline at end of file