[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-stix] STIX timestamps and ISO 8601:2000
On 23.11.2015 12:40:45, Davidson II, Mark S wrote: > TAXII 1.0/1.1 used RFC 3339 timestamps [1], which look like > "1996-12-19T16:39:57-08:00". TAXII additionally specified a maximum > number of milliseconds (e.g., "at most six places of precision"). > > If desired, this group could consider RFC 3339 timestamps with > discussion about which time zone offsets are permitted (if any, or > if everything is required to be in UTC), as well as whether a the > milliseconds portion of the timestamp should have requirements > beyond the RFC. > Obviously all the CTI standards should use a normalized timestamp format. The differences between RFC3339 and ISO 8601 are trivial. (In fact, according to Wikipedia, "RFC 3339...is otherwise a profile of ISO 8601".) We could just flip a coin as far as I'm concerned. More critical requirements are: a) All timestamps MUST be in UTC. b) All timestamps MUST include milliseconds (which MAY be set to all zeros, if the underlying hardward clock doesn't support that level of precision.) c) That there be ONE and ONLY ONE way of doing timestamps in the CTI standards. -- Cheers, Trey -- Trey Darley Senior Security Engineer 4DAA 0A88 34BC 27C9 FD2B A97E D3C6 5C74 0FB7 E430 Soltra | An FS-ISAC & DTCC Company www.soltra.com -- "It Has To Work." --RFC 1925
Attachment:
signature.asc
Description: PGP signature
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]