search

oasis-open / cti-python-stix2

OASIS TC Open Repository: Python APIs for STIX 2
https://stix2.readthedocs.io/
BSD 3-Clause "New" or "Revised" License
367 stars 120 forks source link

The instance of MarkingDefinition cannot pass validation because the 'created' property does't have millisecond. #215

Closed win911 closed 6 years ago

win911 commented 6 years ago

Here is the screenshot: marking

Source code: marking_class

Does the 'created' property should be property to pass validation?

clenk commented 6 years ago

Hi @win911! Marking definitions don't have the same requirement as other objects for created to have millisecond precision. However, when using a marking definition defined in the spec, like TLP, the instance defined in the spec must be used. And the TLP Amber instance defined in the spec does have it precise to the millisecond. The validator is ensuring that it matches the spec instance exactly.

If it wasn't a TLP marking, not having the millisecond would be fine.

win911 commented 6 years ago

Hi @clenk , thanks to your explanation. But how to generate the correct TLP instance defined in the spec? I try to use stix2.TLP_AMBER, but it doesn't have millisecond for created. My objective is to use stix2 module to generate a JSON file which can pass the validation of stix2-validator.

clenk commented 6 years ago

This is a bug in python-stix2 - thanks for finding it! We'll get it fixed soon.