Time-related modifiers

[davaya]

PROBLEM

The language description document does not specify the acceptable time string formats for the "delay", "duration", "frequency", and "time" modifiers.

POTENTIAL SOLUTION

ISO 8601 is the International Standard for time and date formats. It provides maximum flexibility, but software to accommodate the full range of 8601 is complex. RFC 3339, the Internet Profile of 8601, specifies a simplified date and time format by removing options from 8601, e.g., years must be 4 digits between 0000 and 9999 AD, date and time fields are separated by "T", fractional seconds are optional, and timezone must be either Z (for UTC) or an hh:mm offset, with colon, from UTC. Example RFC 3339 date and times are:

2016-05-14T16:39:57Z
1985-04-12T23:20:50.52-05:00

RFC 3339 does not profile 8601 time intervals or durations.

Proposal: The value of the OpenC2 "time" modifier MUST be one of "full-date", "full-time", or "date-time" as defined in RFC 3339 section 5.6.

The value of the OpenC2 "delay", "duration", and "frequency" modifiers MUST be a "duration" value as defined in RFC 3339 Appendix A:

PnYnMnDTnHnMnS
PnW

Example duration values are:

PT1800S    - 1800 seconds (30 minutes)
P5MT30M   - 5 months and 30 minutes
P2W  - 2 weeks

[jyoverma]

We can follow the STIX 2.0 convention on timestamp

------snip from STIX 2.0 Specification-------
The timestampfield MUST​be a valid RFC 3339­formatted timestamp [TODO add
reference] using the format YYYY­MM­DDTHH:mm:ss[.s+]Zwhere the “s+” represents 0
or more sub­second values.
● The timestamp MUST​be represented in the UTC timezone and MUST​use the “Z”
designation to indicate this.
example:
{
...
"created":"2016­01­20T12:31:12.12345Z",
...
}

[romanojd]

Updated modifier vocabulary per recommendation. (RFC 3339).

https://docs.google.com/document/d/1XXG6eWPosD1WLY4l1IFPXd9hKoVMWgM7rwDGgGXPurU/edit#bookmark=id.8w95m4qqko28

Recommend CLOSE.