Re: [cti-cybox] adding CybOX timestamp attribute information

[Tony Rutkowski <tony@yaanatech.com>]

You need both.

In this case, the uncertainty is poor - greater than
the offset.   So the offset isn't important.

In general, offset is critical because it indicates
how much the timestamp deviates from a common
global reference.  Within the U.S. that is the USNO
which is defined as the master clock for the U.S.
The master clocks in different countries are kept
rather close to eachother.

It depends on the use case.  If you're just comparing
events locally or within the same management domain,
and just interested in relative time differences, the
offset against a master clock is not important.  If
those events are scattered across different management
domains, you need the master clock offset.

--tony

On 2015-10-12 3:41 PM, John-Mark Gurney wrote:
> So, I guess you'd like to have additional precisions that are less 
> than a second?  (Say millisecond)  And then an uncertainty value, like 
> in you're case, 3 or 2.648.
>
> I think including the offset is a bit much, as you can just 
> add/subtract the offset value to the time stamp.

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature