CTI STIX Subcommittee

Hi –
 
I had taken an action item to propose the descriptions for 2 relationship timestamp properties. Please review below and suggest changes or acknowledge that these descriptions would be acceptable.
 
To avoid folks focusing on the name of the property I’ve chosen to just call them Relationship Timestamp Field #1 and #2.
 

Relationship Timestamp Field #1

This optional timestamp represents the first time that the relationship between the objects was determined to have occurred. If the timestamp field #1 is a future timestamp, at the time of
the updated field is defined, then this represents an estimate by the producer of the intelligence on when that relationship will exist. If not specified then the relationship between those objects has no determined timestamp.
Relationship Timestamp Field #2


This optional timestamp represents the last time that this relationship between the objects was determined to connect those 2 objects. If the timestamp field #2 is a future timestamp, at
the time of the updated field is defined, then this represents an estimate by the producer of the intelligence on when that relationship will no longer exist. If the timestamp field #2 is defined, then it MUST be later than the timestamp #1 value. If not specified
then the relationship between those objects is considered a persistent relationship.

 
 
Regards
 
Allan

Looks good to me.   From: cti-stix@lists.oasis-open.org [mailto:cti-stix@lists.oasis-open.org] On Behalf Of Allan Thomson Sent: Friday, September 1, 2017 1:53 PM To: cti-stix@lists.oasis-open.org Subject: [Non-DoD Source] [cti-stix] Relationship Timestamp Properties: proposed description for the 2 timestamp parameters   Hi –   I had taken an action item to propose the descriptions for 2 relationship timestamp properties. Please review below and suggest changes or acknowledge that these descriptions would be acceptable.   To avoid folks focusing on the name of the property I’ve chosen to just call them Relationship Timestamp Field #1 and #2.   Relationship Timestamp Field #1 This optional timestamp represents the first time that the relationship between the objects was determined to have occurred. If the timestamp field #1 is a future timestamp, at the time of the updated field is defined, then this represents an estimate by the producer of the intelligence on when that relationship will exist. If not specified then the relationship between those objects has no determined timestamp. Relationship Timestamp Field #2 This optional timestamp represents the last time that this relationship between the objects was determined to connect those 2 objects. If the timestamp field #2 is a future timestamp, at the time of the updated field is defined, then this represents an estimate by the producer of the intelligence on when that relationship will no longer exist. If the timestamp field #2 is defined, then it MUST be later than the timestamp #1 value. If not specified then the relationship between those objects is considered a persistent relationship.     Regards   Allan Attachment: smime.p7s Description: S/MIME cryptographic signature

Looks good...  It goes without saying that both of the timestamps could exist before the object was created and thus the created timestamp. Bret From: cti-stix@lists.oasis-open.org <cti-stix@lists.oasis-open.org> on behalf of Allan Thomson <athomson@lookingglasscyber.com> Sent: Friday, September 1, 2017 11:53:17 AM To: cti-stix@lists.oasis-open.org Subject: [EXT] [cti-stix] Relationship Timestamp Properties: proposed description for the 2 timestamp parameters   Hi –   I had taken an action item to propose the descriptions for 2 relationship timestamp properties. Please review below and suggest changes or acknowledge that these descriptions would be acceptable.   To avoid folks focusing on the name of the property I’ve chosen to just call them Relationship Timestamp Field #1 and #2.   Relationship Timestamp Field #1 This optional timestamp represents the first time that the relationship between the objects was determined to have occurred. If the timestamp field #1 is a future timestamp, at the time of the updated field is defined, then this represents an estimate by the producer of the intelligence on when that relationship will exist. If not specified then the relationship between those objects has no determined timestamp. Relationship Timestamp Field #2 This optional timestamp represents the last time that this relationship between the objects was determined to connect those 2 objects. If the timestamp field #2 is a future timestamp, at the time of the updated field is defined, then this represents an estimate by the producer of the intelligence on when that relationship will no longer exist. If the timestamp field #2 is defined, then it MUST be later than the timestamp #1 value. If not specified then the relationship between those objects is considered a persistent relationship.     Regards   Allan