I just wanted to make sure everyone was aware that we now have 5 different ways of representing time ranges in STIX... Since we tend to split hairs on names, maybe they should just all be named time1 and time2 or do a single field with a dash "-" between the two values and call it "time_window" or "time_range" or something. Relationship Object start_time stop_time Indicator Object valid_from valid_until Campaign, Intrusion Set, Malware first_seen last_seen Malware Analysis Type start_time end_time Observed Data first_observed last_observed Bret