Closed win911 closed 6 years ago
Hi @win911! Marking definitions don't have the same requirement as other objects for created to have millisecond precision. However, when using a marking definition defined in the spec, like TLP, the instance defined in the spec must be used. And the TLP Amber instance defined in the spec does have it precise to the millisecond. The validator is ensuring that it matches the spec instance exactly.
If it wasn't a TLP marking, not having the millisecond would be fine.
Hi @clenk , thanks to your explanation. But how to generate the correct TLP instance defined in the spec? I try to use stix2.TLP_AMBER, but it doesn't have millisecond for created. My objective is to use stix2 module to generate a JSON file which can pass the validation of stix2-validator.
This is a bug in python-stix2 - thanks for finding it! We'll get it fixed soon.
Here is the screenshot:
Source code:
Does the 'created' property should be to pass validation?