Re: [cti-stix] Timestamps - Proposal

From
John-Mark Gurney <>
Date
2015-12-01T21:47:00+00:00
ID
Thread
Re: [cti-stix] Timestamps - Proposal
For 2, there HAS to be a different time specification for intervals and periodicity as they cannot be represented by a simple time stamp.
I'll note that XML already has types to support these things, and xs:dateTime is used in the existing schemas.  They are xs:dateTime and xs:duration:
http://www.w3schools.com/Xml/schema_dtypes_date.asp
So, relative time, periodicity and intervals may all be represented using the xs:duration type.
Interestingly, it looks like in the STIX schema's repo, an external XSD uses xs:duration to represent precision:  ./external/oasis_ciq_3.0/xPIL.xsd: 	  	  	 <xs:attribute name="BirthDateTimePrecision" type="xs:duration">
On Tue, Dec 1, 2015 at 11:57 AM, Patrick Maroney  < 
>  wrote:
Bret,
Presume you will be collecting, coordinating and documenting these so I'll respond directly to your initial message vs. jumping into the the Thread:
2) Timestamps MUST use the timezone offset
Question:  Does this mean there will be another Time Specification for _expression_ of relative time, periodicity and intervals?
4) There will be an optional precision field (timestamp-precision) with the following string values: year, month, day, hour, minute, second. If precision is omitted, the default value of precision is "microsecond"
Question:  Since extending beyond RFC 3339, why can't this option precision type enumeration include millisecond, microsecond, and nanosecond?
Patrick Maroney
Office:   (856)983-0001
Cell:       (609)841-5104

President
Integrated Networking Technologies, Inc.
PO Box 569
Marlton, NJ 08053