CTI TC Timestamps - Proposed: Adopt the ISO 8601 <start>/<end> construct.

[Patrick Maroney <Pmaroney@Specere.org>]

We are reaching final consensus on our CTI TimeStamp deliberations. This is a proposal to add a simple ISO 8601 Standard extension to the CTI TC TimeStamp specification that enables _expression_ of both "Absolute Time" and "Time Range" .

Proposal: 

 (1) Adopt the ISO 8601 <start>/<end> construct.  

(2) All of the constraints we are placing on the CTI Timestamp format remain intact:*

"Absolute Time":   "2015-03-01T13:00:00Z"

"Time Range":       "2015-03-01T13:00:00Z/2016-05-11T15:30:00Z"

(3) Parsing of the ISO 8601 <start>/<end> construct should be straightforward  (i.e., using  standard date-time libraries that support ISO 8601, regex).

*Note : This proposal only argues for the narrow adoption of the "/" Separator and would not allow any of the other ISO 8601 "Time Range "shortcuts" (e.g., "2014-2015", "2015-11-13/15", "2015-02-15/03-14").

There is significant benefit for use cases where there is a very real need to express events, actions, observables, COAs, etc. in time ranges.  For example- statutory incident/intrusion reporting deadline requirements (measured increasingly for many in hours/days) guarantee a need express and revise events in time ranges while investigations gather evidence and more accurately establish the sequence of events and timelines.  There are also many relationships that are more effectively expressed in time ranges, vs. fixed points in time.

Hopefully you see the value in adding this ISO 8601 capability to "our thing".

Patrick Maroney
President
Integrated Networking Technologies, Inc.
Desk: (856)983-0001
Cell: (609)841-5104
Email: pmaroney@specere.org