Agreed, anywhere we have timestamps like this we should add similar language.
From: <cti-stix@lists.oasis-open.org> on behalf of Sean Barnum <sean.barnum@FireEye.com>
Date: Wednesday, August 30, 2017 at 3:48 PM
To: Terry MacDonald <terry.macdonald@cosive.com>, Allan Thomson <athomson@lookingglasscyber.com>
Cc: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>, Sarah Kelley <Sarah.Kelley@cisecurity.org>
Subject: Re: [cti-stix] Small changes from 2.0 - 2.1 - Add a normative requirement for timestamps
I agree with Allan’s tweaks.
I think the same explicit axiomatic constraint should also be asserted for other temporal windows such as valid_from and valid_to.
Sean Barnum
Principal Architect
FireEye
M: 703.473.8262
E: sean.barnum@fireeye.com
From: <cti-stix@lists.oasis-open.org> on behalf of Terry MacDonald <terry.macdonald@cosive.com>
Date: Wednesday, August 30, 2017 at 3:39 PM
To: Allan Thomson <athomson@lookingglasscyber.com>
Cc: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>, Sarah Kelley <Sarah.Kelley@cisecurity.org>
Subject: Re: [cti-stix] Small changes from 2.0 - 2.1 - Add a normative requirement for timestamps
Yep, I like Allan's slight modification. Agree that it's necessary to call this out explicitly.
Cheers
Terry MacDonald
Cosive
On 31/08/2017 05:03, "Allan Thomson" <athomson@lookingglasscyber.com> wrote:
Sarah – generally agree with slight modification to the proposed text.
“If both first_seen and last_seen are present on the object, last_seen MUST be more recent or equal to first_seen”
Allan
From: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org> on behalf of Sarah Kelley <Sarah.Kelley@cisecurity.org>
Date: Wednesday, August 30, 2017 at 7:33 AM
To: "cti-stix@lists.oasis-open.org" <cti-stix@lists.oasis-open.org>
Subject: [cti-stix] Small changes from 2.0 - 2.1 - Add a normative requirement for timestamps
GITHUB issue #13 (https://github.com/oasis-tcs/cti-stix2/issues/13 )
A comment received during the CSD comment period for STIX 2.0 pointed out that we currently have no normative statements stating that when we have a “first_*” timestamp and a “last_*” timestamp, that the “first_*” MUST come before the “last_*. Currently what this means is that it would be valid STIX 2.0 to have a “last_seen” that was five years prior to the corresponding “first_seen”.
We currently have these timestamp pairs (first, last) on the following SDOs (in STIX 2.0):
Campaign
Intrusion Set
Observed Data
Sighting
There is also a proposal to add “first_seen” and “last_seen” to the Relationship SRO (for STIX 2.1).
Are there any objections to adding normative text along the lines of:
“If both first_seen and last_seen are present on the object, first_seen MUST come before last_seen”
Please chime in if there are any objections to adding text in this manner.
Thanks,
Sarah Kelley
Senior Cyber Threat Analyst
Multi-State Information Sharing and Analysis Center (MS-ISAC)
31 Tech Valley Drive
East Greenbush, NY 12061
518-266-3493
24x7 Security Operations Center
SOC@cisecurity.org - 1-866-787-4722
This message and attachments may contain confidential information. If it appears that this message was sent to you by mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. Please notify the sender immediately and permanently delete the message and any attachments.
. . . . .
This email and any attachments thereto may contain private, confidential, and/or privileged material for the sole use of the intended recipient. Any review, copying, or distribution of this email (or any attachments thereto) by others is
strictly prohibited. If you are not the intended recipient, please contact the sender immediately and permanently delete the original and any copies of this email and any attachments thereto.