[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]
Subject: TAXII Version Filter - Please review
All,
Drew, Allan, and I took a stab at fixing the text on the version filter parameter so that can work with a STIX object that does not have a modified timestamp (marking-definition object). The text from section 3.4.1 now reads:
### BEGIN
For STIX objects, this filter option requests objects whose modified time matches exactly the provided value and the value MUST follow the rules for timestamp as defined in [STIX™ Version 2.0. Part 1: STIX Core Concepts].
For STIX objects that do not contain a modified timestamp (ex. the marking-definition object), then this filter should match on the created timestamp. If the STIX object does not contain either a modified or
created timestamp, then this filter should return the latest version according to the server.
For example: "2016-01-01T01:01:01.000Z" tells the server to return the exact STIX object(s) that
matched the modified time or created time (in the case of a marking-definition object) of "2016-01-01T01:01:01.000Z".
### END
The extra caveat for not having either a modified or created timestamp deals with the potential cyber observable changes. Please review and comment on the list with any concerns or changes.
Bret |
[Date Prev] | [Thread Prev] | [Thread Next] | [Date Next] -- [Date Index] | [Thread Index] | [List Home]