[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: Re: [cti-stix] STIX timestamps and ISO 8601:2000
On 20.11.2015 21:01:18, Barnum, Sean D. wrote: > If we are going to revisit this, we will need to make sure that we > have the appropriate voices (incident response, threat analysts, > etc.) involved in the conversation. They are the ones with a clear > understanding of the diverse “real-world” timestamp issues for > threat intel. > > I would suggest adding this as an issue in the tracker. > Naw, we don't need to add this as an issue to the tracker. We can take a decision and just move on. Proposed: STIX 2.0 / CybOX 3.0 timestamps MUST be in ISO 8601 format, MUST be specified in UTC, and MUST include nanosecond precision. (If the underlying tools don't support this level of granularity, then implementers can append zeros.) A la: `date "+%Y-%m-%dT%H:%M:%S.%N%:z"` Simple. Done. Next topic? -- Cheers, Trey -- Trey Darley Senior Security Engineer 4DAA 0A88 34BC 27C9 FD2B A97E D3C6 5C74 0FB7 E430 Soltra | An FS-ISAC & DTCC Company www.soltra.com --
Attachment:
signature.asc
Description: PGP signature
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]