Re: [cti-stix] Timestamps - Proposal

["Jordan, Bret" <bret.jordan@bluecoat.com>]

Doing ranges of time will use multiple timestamps, aka a start-timestamp and end-timestamp.  Another option for certain use cases would be to offer a "duration" field that has a value of time in seconds.  

Thanks,

Bret

Bret Jordan CISSP

Director of Security Architecture and Standards | Office of the CTO

Blue Coat Systems

PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050

"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

On Dec 1, 2015, at 14:46, John-Mark Gurney <jmg@newcontext.com> wrote:

For 2, there HAS to be a different time specification for intervals and periodicity as they cannot be represented by a simple time stamp.

I'll note that XML already has types to support these things, and xs:dateTime is used in the existing schemas.  They are xs:dateTime and xs:duration:

http://www.w3schools.com/Xml/schema_dtypes_date.asp

So, relative time, periodicity and intervals may all be represented using the xs:duration type.

Interestingly, it looks like in the STIX schema's repo, an external XSD uses xs:duration to represent precision:

./external/oasis_ciq_3.0/xPIL.xsd: <xs:attribute name="BirthDateTimePrecision" type="xs:duration">

On Tue, Dec 1, 2015 at 11:57 AM, Patrick Maroney <Pmaroney@specere.org> wrote:

Bret,

Presume you will be collecting, coordinating and documenting these so I'll respond directly to your initial message vs. jumping into the the Thread:

2) Timestamps MUST use the timezone offset

Question:  Does this mean there will be another Time Specification for _expression_ of relative time, periodicity and intervals?

4) There will be an optional precision field (timestamp-precision) with the following string values: year, month, day, hour, minute, second. If precision is omitted, the default value of precision is "microsecond"

Question:  Since extending beyond RFC 3339, why can't this option precision type enumeration include millisecond, microsecond, and nanosecond?

Patrick Maroney

Office:  (856)983-0001

Cell:      (609)841-5104

<C690F973-64C5-4C00-889B-C1A5BB4A2A0B[13].png>

President

Integrated Networking Technologies, Inc.

PO Box 569

Marlton, NJ 08053

Attachment: signature.asc
Description: Message signed with OpenPGP using GPGMail