Changes and Comments of the Incident Spec Doc #44
Conversation
|
|
||
| [width="100%",cols="100%",stripes=odd] | ||
| |=== | ||
| This new sdo extension *MUST* use [stixliteral]#extension-definition--4ca6de00-5b0d-45ef-a1dc-ea7279ea910e# as its extension ID. |
There was a problem hiding this comment.
Was removing this table formatting intentional?
There was a problem hiding this comment.
No - unintentional :-(
Please don't merge this PR - it was for Jeff @dc3-tsd
| @@ -244,9 +244,7 @@ This can be used to supplement the created_by_ref in cases where external author | |||
| <<< | |||
| [[event]] | |||
| === 2.2. Event | |||
|
|
|||
| [width="100%",cols="100%",stripes=odd] | |||
There was a problem hiding this comment.
Please restore table formatting or the document does not properly build.
| @@ -2662,4 +2682,4 @@ Added [stixliteral]#ransom-demand# and [stixliteral]#ransom-payment# to [stixtyp | |||
| |Richard Piazza and Jeffrey Mates | |||
| |Multiple editorial fixes, removing copy paste errors and obsolete relationships. | |||
There was a problem hiding this comment.
Since these are public changes we should probably update the revision history.
| @@ -310,21 +311,23 @@ This is typically used to indicate how an event has affected impacts. | |||
| |[stixtype]#{timestamp_url}[timestamp]# | |||
| |The date and time the event was last recorded. If this is not present it is assumed to be unknown. | |||
|
|
|||
| If *start_time* and *end_time* properties are both defined, then end_time *MUST* be later than the start_time value. | |||
There was a problem hiding this comment.
"equal to or later than" or some other variation. Since we accept the usage of time fidelity it will be common to see the same value for both as many events, tasks, and impacts can be resolved in the same day they they started.
There was a problem hiding this comment.
Yes - I copied that from somewhere in the STIX spec, but it should be "equal to or later than"
No description provided.