Return ptrclassify and DNS record objects for PTR enrichment

[adulau]

Companion object template: MISP/misp-objects#538

Replace standalone classification text and discovered hostname attributes with structured MISP objects. Return one ptrclassify object per classified hostname, with repeated classification, category, label, confidence, evidence and rule-ID fields, plus structured location candidates and classifier hints. Attribute comments identify the label or location candidate associated with each repeated field.

For IPv4/IPv6 lookups, return one dns-record object containing the reverse-DNS owner in queried-domain and all distinct targets in ptr-record. Do not infer forward A/AAAA observations. Classification objects characterize the original attribute and reference the DNS object with derived-from; the DNS object references the queried attribute with related-to.

Preserve the input UUID, existing tags and detection flag. Matching taxonomy tags remain on the queried attribute and each corresponding PTR answer. Newly generated object attributes use to_ids=false; unmatched names return a ptrclassify object with matched=0. Hostname/domain inputs are classified locally without creating a DNS observation.

Includes the new ptrclassify template as a packaged JSON asset for compatibility with older PyMISP releases, updated JSON documentation and examples, and regression tests. MISP instances should install the new object template to manage/import it in the UI.

Validation:

• 47 focused tests and 289 local tests passed, including repeated-field grouping, IPv4/IPv6 DNS objects, tags, references, unmatched names and strict template validation.
• Six API regression tests and a live hostname query passed; the module API returns a templated ptrclassify object.
• Package builds, Black/isort and flake8 checks passed; the wheel contains the exact template proposed in misp-objects.
• Both JSON documentation examples produce the expected objects, tags and fields.

Live external PTR lookup remains unavailable in the cloud environment; deterministic DNS responses cover IP enrichment.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-12T08:28:15.046082Z	a31a566	PR opened
🔒 Security Review	✅ Completed 2026-10-12T08:31:04.370741Z	a31a566	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.