Re: [cti-stix] Timestamps text

All,

I modified the timestamp text per Allan’s (and, separately, Mark Davidson’s) suggestion. Text is here: https://docs.google.com/document/d/1HJqhvzO35h62gQGPvghVRIAtQrZn3_J__0UcDAj-NXY/edit#heading=h.de8ah59mobqf

To make it clear that a value of “second” just meant “the full precision specified by the field”, I renamed “second” in the enumeration to “full”. When that value is specified or the field is omitted (full is the default) then whatever RFC3339 timestamp you have in that field is the precision. So a seconds/fractional seconds of “12” would be precise to the second, “12.1” to the tenth, “12.12” to the hundredth, etc.

This lets us avoid having to populate the enumeration with every possible level of fractional seconds as well as avoid having to pick a very specific default (e.g. microseconds) and require everyone doing milliseconds to specify it every time. I believe it’s also much clearer than saying “second”, so good suggestion, thanks.

Can everyone give that text another review? If it still looks good I’ll make a motion to approve it and move it to draft status.

Thanks,

John

cti-stix message