Re: [cti-stix] STIX timestamps and ISO 8601:2000

[Trey Darley <trey@soltra.com>]

On 20.11.2015 21:01:18, Barnum, Sean D. wrote:
> If we are going to revisit this, we will need to make sure that we
> have the appropriate voices (incident response, threat analysts,
> etc.) involved in the conversation. They are the ones with a clear
> understanding of the diverse “real-world” timestamp issues for
> threat intel.
> 
> I would suggest adding this as an issue in the tracker.
> 

Naw, we don't need to add this as an issue to the tracker. We can take
a decision and just move on.

Proposed: STIX 2.0 / CybOX 3.0 timestamps MUST be in ISO 8601 format,
MUST be specified in UTC, and MUST include nanosecond precision. (If
the underlying tools don't support this level of granularity, then
implementers can append zeros.)

A la: `date "+%Y-%m-%dT%H:%M:%S.%N%:z"`

Simple. Done. Next topic?

-- 
Cheers,
Trey
--
Trey Darley
Senior Security Engineer
4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
Soltra | An FS-ISAC & DTCC Company
www.soltra.com
--

Attachment: signature.asc
Description: PGP signature