The bulk of versioning in STIX is carried out using the timestamp attribute. Unfortunately, this mechanism cannot be used for CybOX, because CybOX entities do not carry the timestamp attribute (except the "Action" entity (and maybe some other ones), where timestamp is used for denoting the time of observation rather than the revision of the CybOX entity).
Versioning using timestamps in STIX works well but currently cannot be applied consistently over a complete STIX document, because the bulk of such documents belongs to the CybOX domain. Therefore,
timestamp attributes should be added to all identifiable constructs in CybOX
guidance documentation should be updated such that versioning in CybOX is aligned
with versioning in STIX
where necessary (e.g., the Action entity), already existing timestamp attributes must be renamed,
e.g.. into 'observation_timestamp' or similar for disambiguation.
The bulk of versioning in STIX is carried out using the timestamp attribute. Unfortunately, this mechanism cannot be used for CybOX, because CybOX entities do not carry the timestamp attribute (except the "Action" entity (and maybe some other ones), where timestamp is used for denoting the time of observation rather than the revision of the CybOX entity).
Versioning using timestamps in STIX works well but currently cannot be applied consistently over a complete STIX document, because the bulk of such documents belongs to the CybOX domain. Therefore,