STIX CS02 Feedback: Sighting first_seen and last_seen

CTI TC,

 

Recommendation: 
If first_seen and last_seen are
 both defined, then last_seen MUST NOT be earlier than the first_seen value.

 

This requirement prevents the ability to provide both first_seen and last_seen
in a Sighting that occurred once where the first_seen and last_seen
are the same. There is a desire to provide first_seen and last_seen
even when they match and the current statement seems to inadvertently prevent this use-case.

 

 

Marlon Taylor

Cybersecurity and Infrastructure Security Agency