OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help

cti message

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]

Subject: Re: [cti] Timestamp Serialization Question

Bret & All:

The only thing I would add is the word "/CybOX" after STIX in the first paragraph.  I believe we talked about this being part of the Common Core, right?  As such, I believe the specification language should call out both standards. 

Jane Ginn

On 1/20/2016 12:32 PM, Jordan, Bret wrote:
I agree.  I would like to motion that we move this out of general debate and move it in to the crafting of normative text.  I think the proposal we can all agree on, or that we have general consensus on is:

Timestamps in STIX will use a single RFC3339 timestamp field that includes the "Z" timezone offset (example: 2016-01-20T12:27:53.123456Z).  All timestamps MUST be in UTC. Timestamps may include any number of subsection precision. A corresponding text precision field with year, month, day, hour, minute, second (default = second). The values for the precision field MUST be all lower-case.  The precision is interpreted the same as ISO-8601, a floor.  The timestamp precision field is optional.  A producer recording time from something in US EST time, would need to convert that time to UTC before sending it across the wire.  

A timestamp know only to a year would look like:
  "timestamp": "2016-00-00T00:00:00Z",
  "timestamp_precision": "year"

A timestamp known only to an hour would look like:
  "timestamp": "2016-01-20T12:00:00Z",
  "timestamp_precision": "hour"

A timestamp known to a second or where the precision is unknown would look like:
  "timestamp": "2016-01-20T12:31:12Z"

A timestamp known to 5 digit sub second precision would look like:
  "timestamp": "2016-01-20T12:31:12.12345Z",



Bret Jordan CISSP
Director of Security Architecture and Standards | Office of the CTO
Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
"Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg." 

[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]