{
  "context": "This criteria evaluates how well the engineer uses PyMISP's specialized object generator functions (make_fail2ban_object, make_git_vuln_finder_object, make_sandbox_signature_object) to create structured MISP objects from security log data. The focus is on correct usage of PyMISP's domain-specific object creation APIs.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Fail2Ban object creation",
      "description": "Uses PyMISP's make_fail2ban_object() function or Fail2banObject class to create ban event objects with appropriate attributes (ip-src, datetime, count, protocol)",
      "max_score": 30
    },
    {
      "name": "GitVulnFinder object creation",
      "description": "Uses PyMISP's make_git_vuln_finder_object() function or GitVulnFinderObject class to create git vulnerability objects with appropriate attributes (repository-url, commit-hash, vulnerability-description, datetime)",
      "max_score": 30
    },
    {
      "name": "Sandbox signature object creation",
      "description": "Uses PyMISP's make_sandbox_signature_object() function or SandboxSignatureObject class to create sandbox detection objects with appropriate attributes (signature-name, signature-type, detection-result, datetime)",
      "max_score": 30
    },
    {
      "name": "Object serialization",
      "description": "Properly converts MISP objects to JSON-serializable format using to_dict() or to_json() methods from the AbstractMISP base class",
      "max_score": 10
    }
  ]
}