From 9e7723878ef682e1160dc74a0d4bd4a1ca4b2e5f Mon Sep 17 00:00:00 2001 From: Alexandre Dulaunoy Date: Thu, 8 Mar 2018 09:44:19 +0100 Subject: [PATCH] fix: clarification regarding published_timestamp Following a discussion with @mokaddem @adulau and @iglocska The clarification came because it was not clear in the RFC about the value of the timestamp if the event was never published. --- misp-core-format/raw.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/misp-core-format/raw.md b/misp-core-format/raw.md index f667e17..749c9c8 100755 --- a/misp-core-format/raw.md +++ b/misp-core-format/raw.md @@ -155,7 +155,7 @@ timestamp is represented as a JSON string. timestamp **MUST** be present. #### publish_timestamp -publish_timestamp represents a reference time when the event was published on the instance. published_timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). At each publication of an event, publish_timestamp **MUST** be updated. The time zone **MUST** be UTC. +publish_timestamp represents a reference time when the event was published on the instance. published_timestamp is expressed in seconds (decimal) since 1st of January 1970 (Unix timestamp). At each publication of an event, publish_timestamp **MUST** be updated. The time zone **MUST** be UTC. If the published_timestamp is present and the published flag is set to false, the publish_timestamp represents the previous publication timestamp. If the event was never published, the published_timestamp **MUST** be set to 0. publish_timestamp is represented as a JSON string. publish_timestamp **MUST** be present.