Timestamp guidance and/or enforcement about schemas

[gtback]

I think that this is best handled by guidance in the documentation rather than schema enforcement, for reasons @bworrell mentions (patterning, regex, etc.)

[johnwunder]

Just wanted to note that we'll want to coordinate this with several STIX tickets, notably:

• STIXProject/schemas#21
• STIXProject/schemas#20

[sbarnum]

Agree that the timezone issue should be documentation on strongly suggested practice that it always be included in timestamps.
Precision will need to be an attribute of the timestamp.

[johnwunder]

I covered xs:date and xs:dateTime in #34. For uses of cyboxCommon:DateTimeObjectPropertyType how about adding a precision attribute as I suggest in #34 and just re-use the cyboxCommon:DateTimePrecisionEnum that will be created?

As for the other issues:

• Timezone is strongly suggested
• Format should match xs:dateTime, unless doing patterning. When doing patterning, assume the target format is xs:dateTime.
• Use of the @precision attribute is invalid for CybOX patterns (when @condition is set to anything other than "Equals") This is the one I'm most wondering about...how would we match against a datetime using both @precision and a CybOX pattern? I say just prohibit or at least strongly discourage it.

[bworrell]

I agree with @johnwunder: I think the precision attribute should be used to add value to instance data, and should be avoided when defining patterns. As such, we should probably clarify that in documentation (suggested practices doc and/or annotations).

[sbarnum]

Why would @precision be invalid for patterns?
I could see there being valid use cases for it.

@precision basically specifies how much of the DateTime typed field is relevant.
For an instance, this means you could specify something like something occurring at any time on a particular date.

You may want to say something similar in a pattern. For example, any File with a Created_Time occurring on 11/19/13. Technically you could do this by specifying a range of 11/19/13 00:00:00 to 11/19/13 23:59:59 but that seems kind of silly if we now have a @precision attribute to specify how much of the DateTime is relevant.

Is there some issue that I am missing why we would want to discourage @precision in patterns?

sean

From: John Wunder <[email protected]mailto:[email protected]>
Reply-To: CybOXProject/schemas <[email protected]mailto:[email protected]>
Date: Tuesday, November 19, 2013 11:21 AM
To: CybOXProject/schemas <[email protected]mailto:[email protected]>
Cc: "Barnum, Sean D." <[email protected]mailto:[email protected]>
Subject: Re: [schemas] Timestamp guidance and/or enforcement (#11)

I covered xs:date and xs:dateTime in #34#34. For uses of cyboxCommon:DateTimeObjectPropertyType how about adding a precision attribute as I suggest in #34#34 and just re-use the cyboxCommon:DateTimePrecisionEnum that will be created?

As for the other issues:

• Timezone is strongly suggested
• Format should match xs:dateTime, unless doing patterning. When doing patterning, assume the target format is xs:dateTime.
• Use of the @precision attribute is invalid for CybOX patterns (when @condition is set to anything other than "Equals") This is the one I'm most wondering about...how would we match against a datetime using both @precisionhttps://github.com/precision and a CybOX pattern? I say just prohibit or at least strongly discourage it.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/11#issuecomment-28798203.