Fwd: STIX timestamps and ISO 8601:2000

[Jerome Athias <athiasjerome@gmail.com>]

Back to the future


---------- Forwarded message ----------
From: Jerome Athias <athiasjerome@gmail.com>
Date: 2014-02-10 10:10 GMT+03:00
Subject: Re: STIX Content Revision and Revocation
To: "Wunder, John A." <jwunder@mitre.org>
Cc : Terry MacDonald <terry.macdonald@gmail.com>, Patrick Maroney
<Pmaroney@specere.org>, "Grobauer, Bernd"
<Bernd.Grobauer@siemens.com>, "Taylor, Marlon"
<Marlon.Taylor@hq.dhs.gov>, DisplayName <patrick.maroney@mac.com>,
"Barnum, Sean D." <sbarnum@mitre.org>, Kyle Maxwell
<krmaxwell@gmail.com>, Dave Dittrich <dittrich@u.washington.edu>,
stix-discussion-list Structured Threat Information Expression/ST
<stix-discussion-list@lists.mitre.org>


I would see xs:datetime as "an implementation of strings formatted
according to a subset of ISO 8601:2000, documented in RFC 3339."
http://www.w3.org/TR/xmlschema-2/#isoformats
http://tools.ietf.org/html/rfc3339

so no "differences"

2014-02-10 Wunder, John A. <jwunder@mitre.org>:
> Hey guys,
>
>
>
> I have a quick question about RFC3339 vs. XML Schema's dateTime. I looked
> into them briefly and as far as I can tell they are very similar...some small
> differences in what each allows (capital T to denote time vs. either capital
> or lowercase, things like that). Are there important differences that make
> RFC3339 better than xs:dateTime that I'm missing? The nice thing about
> xs:dateTime is that, as long as STIX is in XML it natively validates, vs.
> RFC3339 which we would have to validate (and wouldn't work as well in
> programmatic bindings).
>
>
>
> Note: I'm basing this off of this mailing list post regarding Atom, so it's
> very possible I just don't understand the differences:
> http://www.imc.org/atom-syntax/mail-archive/msg13103.html.
>
>
>
> Thanks,
>
> John
>
>
>
> From: Terry MacDonald [mailto:terry.macdonald@gmail.com]
> Sent: Sunday, February 09, 2014 8:20 PM
> To: Patrick Maroney
> Cc: Grobauer, Bernd; Taylor, Marlon; DisplayName; Barnum, Sean D.; Wunder,
> John A.; Kyle Maxwell; Dave Dittrich; stix-discussion-list Structured Threat
> Information Expression/ST
> Subject: Re: STIX Content Revision and Revocation
>
>
>
> [+1] again on the RFC3339 (In UTC with 6 digits of precision) for me too
> please.
>
>
>
> Cheers
>
>
>
> Terry MacDonald
>
>
> Terry MacDonald
>
>
>
> On 10 February 2014 14:02, Patrick Maroney <Pmaroney@specere.org> wrote:
>
> [+1]   For a universal (optional) timestamp attribute( (RFC3339 in UTC with
> at last 6 digits of precision for  'time-secfrac').  Understand we will need
> to defer on other related attributes (like potential CRUD/change modality)
> to give it the attention this needs   However, this change would help lay
> the foundations for a unified temporal reference (or at least the ability to
> assert same ;-).
>
>
>
> Patrick Maroney
> Executive Director
> Defense Security Information Exchange (DSIE)
> Office: (856)983-0001
> Cell: (609)841-5104
> pmaroney@specere.org
>
> ________________________________
>
> From: owner-stix-discussion-list@lists.mitre.org
> <owner-stix-discussion-list@lists.mitre.org> on behalf of Grobauer, Bernd
> <Bernd.Grobauer@siemens.com>
> Sent: Sunday, February 09, 2014 2:48:01 PM
> To: Taylor, Marlon; DisplayName; Barnum, Sean D.
>
>
> Cc: Wunder, John A.; Terry MacDonald; Kyle Maxwell; Dave Dittrich;
> stix-discussion-list Structured Threat Information Expression/ST
>
> Subject: RE: STIX Content Revision and Revocation
>
>
>
> Hi,
>
>
>
> I pretty much agree with Marlon's answers to the open questions put by Sean.
> Looking at
>
> draft 2 of version 1.1 of Stix, I would like to add my vote to Marlon's
> answer to question
>
> 10 "Should an additional @timestamp attribute be added to each contstruct.".
> Marlon
>
> prefers the attribute, and so do I: timestamp information is such essential
> information,
>
> that it should be on top-level right next to the identifier rather than
> somewhere below
>
> in the (optional!!) "Information_Source/Time/Produced_Time" element.
>
>
>
> Also: I think on must be able to add timestamp information to really every
> object
>
> that has an identifier: I am not sure that every object I want to timestamp
> has the 'Information_Source'-substructure:
>
> making '@timestamp' an attribute next to any place where an '@id' attribute
> occurs makes sure
>
> that any object can be timestamped.
>
>
>
> So, in short: although this comes rather late in the timeline of STIX 1.1: I
> really think
>
> that draft 2 should be changed with regards to the location of where the
> timestamp information
>
> is kept: make '@timestamp' a sibling of '@id', '@id_ref' and
> '@timestamp_ref'  rather
>
> than keeping the timestamp in "Information_Source/Time/Produced_Time".
>
>
>
> Kind regards,
>
>
>
> Bernd
>
>
>
>