cti-comment message

Subject: START/STOP timestamps in STIX Patterns

From: Drew Varner <drew.varner@ninefx.com>
To: cti-comment@lists.oasis-open.org
Date: Sat, 16 Dec 2017 13:10:52 -0500

The examples in STIX 2 Patterns for START/STOP shows timestamps as strings.

```
[file:name = 'foo.dll'] START '2016-06-01T00:00:00Z' STOP '2016-07-01T00:00:00Z'
```

Should these be STIX 2 Pattern timestamp literals?

```
[file:name = 'foo.dll'] START t'2016-06-01T00:00:00Z' STOP t'2016-07-01T00:00:00Z'
```

Thanks,
Drew