Timestamp guidance and/or enforcement

[bworrell]

CybOX currently uses xs:dateTime and cyboxComon:DateTimeObjectPropertyType to store datetime information. DateTimeObjectPropertyType does not constrain values to xs:dateTime formats or enforce the use of timezone information, which is often essential when communicating cyber observable information.

Community members have identified the need to store more granular datetime information such as timezones information, which is not currently enforced by schema.

Pattern restricting the fields in schema may not be possible due to the CybOX patterning capability requirements (a regex does not conform to the xs:dateTime format), so we may just need to provide guidance on how best to store datetime information in both schema annotations and the specifications.

[gtback]

I think that this is best handled by guidance in the documentation rather than schema enforcement, for reasons @bworrell mentions (patterning, regex, etc.)

[johnwunder]

Just wanted to note that we'll want to coordinate this with several STIX tickets, notably:

• STIX needs to require the deterministic specification of a timezone STIXProject/schemas#21
• STIX needs some mechanism for capturing the precision of timestamps STIXProject/schemas#20

[sbarnum]

Agree that the timezone issue should be documentation on strongly suggested practice that it always be included in timestamps.
Precision will need to be an attribute of the timestamp.

[johnwunder]

I covered xs:date and xs:dateTime in #34. For uses of cyboxCommon:DateTimeObjectPropertyType how about adding a precision attribute as I suggest in #34 and just re-use the cyboxCommon:DateTimePrecisionEnum that will be created?

As for the other issues:

• Timezone is strongly suggested
• Format should match xs:dateTime, unless doing patterning. When doing patterning, assume the target format is xs:dateTime.
• Use of the @precision attribute is invalid for CybOX patterns (when @condition is set to anything other than "Equals") This is the one I'm most wondering about...how would we match against a datetime using both @precision and a CybOX pattern? I say just prohibit or at least strongly discourage it.

[bworrell]

I agree with @johnwunder: I think the precision attribute should be used to add value to instance data, and should be avoided when defining patterns. As such, we should probably clarify that in documentation (suggested practices doc and/or annotations).

[sbarnum]

Why would @precision be invalid for patterns?
I could see there being valid use cases for it.

@precision basically specifies how much of the DateTime typed field is relevant.
For an instance, this means you could specify something like something occurring at any time on a particular date.

You may want to say something similar in a pattern. For example, any File with a Created_Time occurring on 11/19/13. Technically you could do this by specifying a range of 11/19/13 00:00:00 to 11/19/13 23:59:59 but that seems kind of silly if we now have a @precision attribute to specify how much of the DateTime is relevant.

Is there some issue that I am missing why we would want to discourage @precision in patterns?

sean

From: John Wunder <notifications@github.commailto:notifications@github.com>
Reply-To: CybOXProject/schemas <reply@reply.github.commailto:reply@reply.github.com>
Date: Tuesday, November 19, 2013 11:21 AM
To: CybOXProject/schemas <schemas@noreply.github.commailto:schemas@noreply.github.com>
Cc: "Barnum, Sean D." <sbarnum@mitre.orgmailto:sbarnum@mitre.org>
Subject: Re: [schemas] Timestamp guidance and/or enforcement (#11)

I covered xs:date and xs:dateTime in #34#34. For uses of cyboxCommon:DateTimeObjectPropertyType how about adding a precision attribute as I suggest in #34#34 and just re-use the cyboxCommon:DateTimePrecisionEnum that will be created?

As for the other issues:

• Timezone is strongly suggested
• Format should match xs:dateTime, unless doing patterning. When doing patterning, assume the target format is xs:dateTime.
• Use of the @precision attribute is invalid for CybOX patterns (when @condition is set to anything other than "Equals") This is the one I'm most wondering about...how would we match against a datetime using both @precisionhttps://github.com/precision and a CybOX pattern? I say just prohibit or at least strongly discourage it.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/11#issuecomment-28798203.