Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using UTC timezone for time_first & time_last datetime values #34

Merged
merged 1 commit into from
Sep 30, 2024

Conversation

chrisr3d
Copy link
Member

The recorded values for those fields are UTC timestamps.

I discovered the UTC timezone was not specified while playing with the Passive DNS MISP module, where I had different values displayed - and displayed only - between the first_seen field of the MISP object and the time_first attribute - same with respectively last_seen and time_last attribute - even though it is the same value that is used.

It is not as bad as I first thought it was in my case though, as MISP interprets datetime values with no specific timezone as UTC by default, and I had the timestamps converted into the right UTC datetime values in the final result on MISP Events/Attributes/Objects.
But I would still set the UTC timezone to avoid issue with third party services or scripts querying MISP modules and potentially parsing the results before pushing them to MISP.

This is only the MISP integration point of view, but I don't think it should break any code using pypdns, as the fields that are concerned by the change still have the exact same datetime format, the only difference is the timezone parameter.
Let me know if you see any blocker

… values

- As the recorded values for those fields are supposed to be UTC timestamps.
@Rafiot Rafiot self-assigned this Sep 26, 2024
@Rafiot
Copy link
Member

Rafiot commented Sep 26, 2024

I think it is correct, good catch. In Python a datetime without a TZ is considered as local TZ, but when importing from a timestamp (which is UTC), it will break it, you're 100% correct.

I'll validate it before merging.

@Rafiot Rafiot merged commit 9c6f7b0 into CIRCL:main Sep 30, 2024
3 of 8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants