CTI TC,
Recommendation:
If first_seen and last_seen are
both defined, then last_seen MUST NOT be earlier than the first_seen value.
This requirement prevents the ability to provide both first_seen and last_seen
in a Sighting that occurred once where the first_seen and last_seen
are the same. There is a desire to provide first_seen and last_seen
even when they match and the current statement seems to inadvertently prevent this use-case.
Marlon Taylor
Cybersecurity and Infrastructure Security Agency
