Re: [cti-stix] [jmg@newcontext.com: Observed Data comments.]

On 31/08/2016 6:25 AM, "John-Mark Gurney" <jmg@newcontext.com> wrote:

Did this get lost in the shuffle last week? I didn't see any discussion
on this.

----- Forwarded message from John-Mark Gurney <jmg@newcontext.com> -----

Date: Mon, 22 Aug 2016 17:08:44 -0700
From: John-Mark Gurney <jmg@newcontext.com>
To: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: Observed Data comments.

Hello,

Sorry for not getting this in sooner, but I have questions/comments
about the Observed Data object.

There is nothing in the spec that requires first_observed to be equal
to last_observed when number_observed is 1.

How is a tool who receives such an object to handle this?

In the case of when you don't know exactly when the observed data
was recorded, the _presision property added to first_observed can
convey this information correctly, and most acurately.

P.S. IMO, we should also make the number_observed default to 1, and
make it optional. By setting a resonable default, we can reduce
the size of objects in common cases.

--
John-Mark

----- End forwarded message -----

--
John-Mark

---------------------------------------------------------------------
To unsubscribe from this mail list, you must leave the OASIS TC that
generates this mail. Follow this link to all your TCs in OASIS at:
https://www.oasis-open.org/apps/org/workgroup/portal/my_workgroups.php

cti-stix message