- Bob is preparing a publication for the next RSA conference because his boss told him to. He creates a Report object, and the created_date is set
- Bob and his colleague Rita add objects to the Report object in preparation for the publication date. They both update the Report object, and each time the revision is increased, and the modified_date is set
- The RSA conference is tomorrow. Bob is just about to distribute the Report object out to their public TAXII server, so he sets the published_date, increments the revision number, sets the modified_date, and then pushes the object to the public server.
- 2 weeks later Bob finds out that they accidentally included an Observation object in the report that was for another threat actor. Bob removes that Observation object from the Report object, increments the revision number, sets the modified_date, and then pushes the object to the public server. The published_date stays at the date that the Report was first made public. Even though an 'Errata' has been published, this is not tracked through the published_date.
Does that clarify usage? What do people think?
My opinion: I think its a good idea.
Cheers
Terry MacDonald | Chief Product Officer
On Wed, Jun 1, 2016 at 11:42 AM, Jordan, Bret <bret.jordan@bluecoat.com> wrote:
Really briefly, I have been thinking about our report object and I think we should define an optional field called "published_date" to capture the marketing / PR date that the report was published.
Bret
Sent from my Commodore 64
---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail. Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php