Time Ranges

[Bret Jordan <Bret_Jordan@symantec.com>]

I just wanted to make sure everyone was aware that we now have 5 different ways of representing time ranges in STIX...  Since we tend to split hairs on names, maybe they should just all be named time1 and time2 or do a single field with a dash "-" between the two values and call it "time_window" or "time_range" or something. 

Relationship Object

start_time

stop_time

Indicator Object

valid_from

valid_until

Campaign, Intrusion Set, Malware

first_seen

last_seen

Malware Analysis Type

start_time

end_time

Observed Data

first_observed

last_observed

Bret