Re: [cti] timestamp proposal for STIX 2.0 RC3

["Wunder, John A." <jwunder@mitre.org>]

Hey everyone,

 

I wanted to follow up to this thread and the conversation on the call today with the normative text that we’ve drafted for timestamps so you have something solid to look at. So, assuming we were to develop an alternative to the current approach to capture float Unix epochs, would this text work for everyone? Any suggestions or corrections?

 

The next step after we solidify this proposal is to open a ballot on whether we should keep the current timestamp text (RFC3339/ISO8601) or switch to this text. But first let’s make sure we all agree on what the alternative is so that people can vote between two well-defined options.

 

Thanks,

John

 

2.10.  Timestamp

Type Name: timestamp

 

Timestamps in STIX are represented as a number of seconds since the Unix epoch (January 1, 1970) in UTC (Coordinated Universal Time).

 

The JSON MTI serialization uses the JSON number type <TODO: add reference> when representing timestamp.

 

2.10.1.  Requirements

·         The timestamp field MUST be positive decimal number between 0 and 4102462800 (January 1, 2100) containing no more than picosecond precision.

·         The timestamp field MUST represent a number of seconds since January 1, 1970, in UTC (Coordinated Universal Time) as defined by ITU-R TF.460-6.