Re: [cti] Timestamp precision

["Wunder, John A." <jwunder@mitre.org>]

Thanks Trey, same. I think we should get 2.0 out there and then see if we need to add precision anywhere once we get real usage.

I’m also curious whether companies like Soltra and EclecticIQ implemented precision in STIX 1.2 (I believe it was added to 1.1). Does anybody know of any implementations that used precision in 1.x and, if so, how it was implemented and whether analysts used it?

John

On 12/7/16, 3:51 AM, "Trey Darley" <trey@kingfisherops.com> wrote:

    On 06.12.2016 17:32:01, Wunder, John A. wrote:
    > 
    > I see three options:
    > 
    > 
    > 1. Keep as-is
    > 
    > 2. Remove precision from all fields and add it as necessary
    > 
    > 3. Evaluate it on a field-by-field basis
    > 
    
    I'm in favor of option 2.
    
    -- 
    Cheers,
    Trey
    ++--------------------------------------------------------------------------++
    Kingfisher Operations, sprl
    gpg fingerprint: 85F3 5F54 4A2A B4CD 33C4  5B9B B30D DD6E 62C8 6C1D
    ++--------------------------------------------------------------------------++
    --
    "Just wait till time intervenes. The alchemy of time transforms
    everything into comedy. Everything..." --Josef Škvorecký