[jmg@newcontext.com: Observed Data comments.]

[John-Mark Gurney <jmg@newcontext.com>]

Did this get lost in the shuffle last week?  I didn't see any discussion
on this.

----- Forwarded message from John-Mark Gurney <jmg@newcontext.com> -----

Date: Mon, 22 Aug 2016 17:08:44 -0700
From: John-Mark Gurney <jmg@newcontext.com>
To: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: Observed Data comments.

Hello,

Sorry for not getting this in sooner, but I have questions/comments
about the Observed Data object.

There is nothing in the spec that requires first_observed to be equal
to last_observed when number_observed is 1.

How is a tool who receives such an object to handle this?

In the case of when you don't know exactly when the observed data
was recorded, the _presision property added to first_observed can
convey this information correctly, and most acurately.

P.S. IMO, we should also make the number_observed default to 1, and
make it optional.  By setting a resonable default, we can reduce
the size of objects in common cases.

-- 
John-Mark

----- End forwarded message -----

-- 
John-Mark