<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Dear Moto,</p>
<p>First of all, thanks for providing feedback!<br>
</p>
<div class="moz-cite-prefix">On 9/7/21 2:40 AM, moto kawasaki wrote:
</div>
<blockquote type="cite"
cite="mid:20210907.094028.1714939875838089049.moto@kawasaki3.org">
<pre class="moz-quote-pre" wrap="">Regarding IEP004, I'd second the current proposal and Variant
AIL. That is natural and easy to understand.</pre>
</blockquote>
Thanks.<br>
<blockquote type="cite"
cite="mid:20210907.094028.1714939875838089049.moto@kawasaki3.org">
<pre class="moz-quote-pre" wrap="">But don't we need to have a timestamp in the meta-data ?
I mean something like this;
{
"format": "intelmq",
"version": 1,
"type": "event",
"meta": {
"intelmq:uuid": "<event-uuid-1>",
"intelmq:uuid_org": "<org-uuid-1>",
"intelmq:timestamp": "<creation time of this message>", <== here
:</pre>
</blockquote>
Every IntelMQ message should already have a <i>time.source</i>
field in the payload, so I'm not sure if it's necessary to have it
in the metadata as well explicitly. And that overlaps with the next
topic:<br>
<blockquote type="cite"
cite="mid:20210907.094028.1714939875838089049.moto@kawasaki3.org">
<pre class="moz-quote-pre" wrap="">With this timestamp, we don't need to consider a time-sortable UUID
but just use UUID-whatever.</pre>
</blockquote>
Not necessarily. Events are usually identified in User-Interfaces
and databases by an ID, a numeric one or alphanumeric. I'm just
thinking of MISP, which shows numeric IDs in the event lists. For
IntelMQ similar interfaces exist
(<a class="moz-txt-link-freetext" href="https://github.com/Intevation/intelmq-fody/">https://github.com/Intevation/intelmq-fody/</a>) as well as plain
databases. If the data is already automatically time-sortable by the
primary identifier, the usability could benefit. In same cases the
performance could increase as well.<br>
<blockquote type="cite"
cite="mid:20210907.094028.1714939875838089049.moto@kawasaki3.org">
<pre class="moz-quote-pre" wrap="">If you've already discussed and decided not to have it, please ignore
and receive my apology to rehash old discussion.
</pre>
</blockquote>
<p>No, we haven't discussed that yet :)</p>
<p>best regards<br>
Sebastian<br>
</p>
<pre class="moz-signature" cols="72">--
// Sebastian Wagner <a class="moz-txt-link-rfc2396E" href="mailto:wagner@cert.at"><wagner@cert.at></a> - T: +43 676 898 298 7201
// CERT Austria - <a class="moz-txt-link-freetext" href="https://www.cert.at/">https://www.cert.at/</a>
// Eine Initiative der nic.at GmbH - <a class="moz-txt-link-freetext" href="https://www.nic.at/">https://www.nic.at/</a>
// Firmenbuchnummer 172568b, LG Salzburg</pre>
</body>
</html>