OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

cti-stix message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: [cti-stix] STIX timestamps and ISO 8601:2000

On 23.11.2015 12:40:45, Davidson II, Mark S wrote:
> TAXII 1.0/1.1 used RFC 3339 timestamps [1], which look like
> "1996-12-19T16:39:57-08:00". TAXII additionally specified a maximum
> number of milliseconds (e.g., "at most six places of precision").
> If desired, this group could consider RFC 3339 timestamps with
> discussion about which time zone offsets are permitted (if any, or
> if everything is required to be in UTC), as well as whether a the
> milliseconds portion of the timestamp should have requirements
> beyond the RFC.

Obviously all the CTI standards should use a normalized timestamp
format. The differences between RFC3339 and ISO 8601 are trivial. (In
fact, according to Wikipedia, "RFC 3339...is otherwise a profile of
ISO 8601".) We could just flip a coin as far as I'm concerned.

More critical requirements are:
  a) All timestamps MUST be in UTC.
  b) All timestamps MUST include milliseconds (which MAY be set to all
     zeros, if the underlying hardward clock doesn't support that level
     of precision.)
  c) That there be ONE and ONLY ONE way of doing timestamps in the CTI

Trey Darley
Senior Security Engineer
4DAA 0A88 34BC 27C9 FD2B  A97E D3C6 5C74 0FB7 E430
Soltra | An FS-ISAC & DTCC Company
"It Has To Work." --RFC 1925

Attachment: signature.asc
Description: PGP signature

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]