OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

cti-stix message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: [cti-stix] STIX timestamps and ISO 8601:2000

On 20.11.2015 21:01:18, Barnum, Sean D. wrote:
> If we are going to revisit this, we will need to make sure that we
> have the appropriate voices (incident response, threat analysts,
> etc.) involved in the conversation. They are the ones with a clear
> understanding of the diverse “real-world” timestamp issues for
> threat intel.
> I would suggest adding this as an issue in the tracker.

Naw, we don't need to add this as an issue to the tracker. We can take
a decision and just move on.

Proposed: STIX 2.0 / CybOX 3.0 timestamps MUST be in ISO 8601 format,
MUST be specified in UTC, and MUST include nanosecond precision. (If
the underlying tools don't support this level of granularity, then
implementers can append zeros.)

A la: `date "+%Y-%m-%dT%H:%M:%S.%N%:z"`

Simple. Done. Next topic?

Trey Darley
Senior Security Engineer
4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
Soltra | An FS-ISAC & DTCC Company

Attachment: signature.asc
Description: PGP signature

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]