Re: [EXT] [cti-stix] Relationship Timestamp Properties: proposed description for the 2 timestamp parameters

[Bret Jordan <Bret_Jordan@symantec.com>]

Looks good...  It goes without saying that both of the timestamps could exist before the object was created and thus the created timestamp.

Bret

---

From: cti-stix@lists.oasis-open.org <cti-stix@lists.oasis-open.org> on behalf of Allan Thomson <athomson@lookingglasscyber.com>
Sent: Friday, September 1, 2017 11:53:17 AM
To: cti-stix@lists.oasis-open.org
Subject: [EXT] [cti-stix] Relationship Timestamp Properties: proposed description for the 2 timestamp parameters

 

Hi –

 

I had taken an action item to propose the descriptions for 2 relationship timestamp properties. Please review below and suggest changes or acknowledge that these descriptions would be acceptable.

 

To avoid folks focusing on the name of the property I’ve chosen to just call them Relationship Timestamp Field #1 and #2.

 

1. Relationship Timestamp Field #1
   1. This optional timestamp represents the first time that the relationship between the objects was determined to have occurred. If the timestamp field #1 is a future timestamp, at the time of the updated field is defined, then this represents an estimate by the producer of the intelligence on when that relationship will exist. If not specified then the relationship between those objects has no determined timestamp.
2. Relationship Timestamp Field #2

1. This optional timestamp represents the last time that this relationship between the objects was determined to connect those 2 objects. If the timestamp field #2 is a future timestamp, at the time of the updated field is defined, then this represents an estimate by the producer of the intelligence on when that relationship will no longer exist. If the timestamp field #2 is defined, then it MUST be later than the timestamp #1 value. If not specified then the relationship between those objects is considered a persistent relationship.

 

 

Regards

 

Allan