Re: [cti-stix] Timestamps

cti-stix message

For 2, there HAS to be a different time specification for intervals and periodicity as they cannot be represented by a simple time stamp.

I'll note that XML already has types to support these things, and xs:dateTime is used in the existing schemas. They are xs:dateTime and xs:duration:

http://www.w3schools.com/Xml/schema_dtypes_date.asp

So, relative time, periodicity and intervals may all be represented using the xs:duration type.

Interestingly, it looks like in the STIX schema's repo, an external XSD uses xs:duration to represent precision:

./external/oasis_ciq_3.0/xPIL.xsd: <xs:attribute name="BirthDateTimePrecision" type="xs:duration">

On Tue, Dec 1, 2015 at 11:57 AM, Patrick Maroney <Pmaroney@specere.org> wrote:

Bret,

Presume you will be collecting, coordinating and documenting these so I'll respond directly to your initial message vs. jumping into the the Thread:

2) Timestamps MUST use the timezone offset

Question: Does this mean there will be another Time Specification for _expression_ of relative time, periodicity and intervals?

4) There will be an optional precision field (timestamp-precision) with the following string values: year, month, day, hour, minute, second. If precision is omitted, the default value of precision is "microsecond"

Question: Since extending beyond RFC 3339, why can't this option precision type enumeration include millisecond, microsecond, and nanosecond?

Patrick Maroney

Office: (856)983-0001

Cell: (609)841-5104

President

Integrated Networking Technologies, Inc.

PO Box 569

Marlton, NJ 08053