[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-stix] Timestamps - Proposal
+1. Microseconds are enough. Let's move on.
From: Jordan, Bret [mailto:bret.jordan@bluecoat.com]
This is generally why we decided to place some table stakes in the ground and call it good. The proposal on the floor is for microsecond level precision, meaning 6 sub-second digits (most modern tools can and do support this, older tools may be limited).
Sent: Tuesday, December 01, 2015 04:54 PM Eastern Standard Time To: Terry MacDonald <terry@soltra.com> Cc: tony@yaanatech.com <tony@yaanatech.com>; Patrick Maroney <Pmaroney@Specere.org>; cti-stix@lists.oasis-open.org <cti-stix@lists.oasis-open.org> Subject: Re: [cti-stix] Timestamps - Proposal We can debate esoteric requirements and corner cases forever. I would much rather get STIX 2.0 out the door and if we need to add something like nano seconds later, we can do that. People that can only do millisecond level precision should just
zero out the last three digits. And given jitter in NTP it does not really matter that they are zeroed because your accuracy is only to about a second anyway.
The way this would look is like:
{
"timestamp": "2015-12-01T14:52:12.123456-06:00"
}
or
{
"timestamp": "2015-12-01T14:00:00.000000-06:00",
"timestamp-precision": "hour"
}
Thanks,
Bret
Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447 F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg."
|
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]