STIX 2.0 Proposal1 : Extend core constructs from a single base class (#148)

First, I like a lot of the ideas and concepts discussed in Proposal 1.  A few comments and questions....
1) In regards to the open question about should time stamps be required, I guess that depends on what the time stamp is telling us at this level.  I believe, at this high level, it is telling us the time in which the object was created / processed, and if that is truly the case, then I believe it should be required.
2) Based on the JSON style guide that the CybOX group has started working on, that was donated by EclecticIQ, I would say that Timestamps should be flat not nested.  Now I understand why it may have been marked up the way you have it, based on the desire to accommodate the timestamp.precision field, but I believe this would be best done differently. Namely, from your example 1 you have:
{
     id :  example:ttp-6796e1db-a84d-4017-87d5-cdebfe4303be ,      type :  malware-instance ,      timestamp : {  value  :  2015-12-21T19:59:11.000000+00:00 },      title :  Sakurel Malware
}
I would suggest that be (changes in red):
{
     id :  example:ttp-6796e1db-a84d-4017-87d5-cdebfe4303be ,
     type :  malware-instance ,
     timestamp :  2015-12-21T19:59:11.000000+00:00 ,
     timestamp_precision :  second ,
     title :  Sakurel Malware
}
This is easier to process, skip, or apply default values to.  Further, having a nested object just for 2 options, when one of them will most likely never be present, is a bit messy.
Thanks,
Bret
Bret Jordan CISSP
Director of Security Architecture and Standards
Office of the CTO  Blue Coat Systems
PGP Fingerprint: 63B4 FC53 680A 6B7D 1447  F2C0 74F8 ACAE 7415 0050
Without cryptography vihv vivc ce xhrnrw, however, the only thing that can not be unscrambled is an egg.
Attachment:
signature.asc
Description:  Message signed with OpenPGP using GPGMail