RE: [cti-stix] STIX timestamps and ISO 8601:2000

["Struse, Richard" <Richard.Struse@HQ.DHS.GOV>]

Are there any generally-available tools or technologies that produce
timestamps with nanosecond precision today?  If we can't identify any I
would suggest that we support 6 digits (microseconds) and be done. 

This is a trivial but important way that we can communicate to the broader
community that we are rooted in real-world practice.

-----Original Message-----
From: cti-stix@lists.oasis-open.org [mailto:cti-stix@lists.oasis-open.org]
On Behalf Of Tony Rutkowski
Sent: Monday, November 23, 2015 2:23 PM
To: Jordan, Bret; Trey Darley
Cc: Jason Keirstead; Jerome Athias; cti-stix@lists.oasis-open.org; Wunder,
John A.; Patrick Maroney; Sean D. Barnum
Subject: Re: [cti-stix] STIX timestamps and ISO 8601:2000

It's not inconceivable that fractional microsecond
values matter in virtualization environments.within
the same facility.  On a larger scale, the uncertainties
associated with the timestamp value will make
nanosecond precision moot.

Has anyone articulated what the overhead
differential is of an expression with a precision
of microseconds versus nanoseconds?

-t

On 2015-11-23 01:08 PM, Jordan, Bret wrote:
> I miss typed in my last email, I meant to say micro seconds not 
> milliseconds, aka 6 digits of precision not 3 digits of precision. 
>  Wireshark and other networking / security tools are able to work with 
> and provide 6 digits of precision. That is VERY common. What is not 
> really common today is 9 digits of precision.
>

Attachment: smime.p7s
Description: S/MIME cryptographic signature