Description
Compare supplied public advisory timestamps without evaluating threats or recommending operational action.
Security records often depend on explicit counts, clock origins, status flags, and provenance dates. Checking their internal arithmetic can reveal a bookkeeping gap while leaving the underlying evidence and operational decisions for separate review.
Compare supplied public advisory timestamps without evaluating threats or recommending operational action.
When to use this tool
Use it for advisory publication lag when the required inputs and conventions are already available.
How to use the tool and how it works
- Enter eventTime, publicationTime, suppliedClockOffset. Use the stated units and boundary conventions.
- Run the calculation. Correct any input error before interpreting a result.
- Read lag, precedesEvent. Inspect any known, defined, inclusion, or boundary flags before interpreting numeric values.
Subtract suppliedClockOffset from publicationTime and compare the normalized value with eventTime. Return signed lag and a strict precedesEvent flag.1
| Input field | Meaning and units | Accepted input |
|---|---|---|
| eventTime | Event Time | Required. Finite number. |
| publicationTime | Publication Time | Required. Finite number. |
| suppliedClockOffset | Supplied Clock Offset | Required. Finite number. |
| Output field | Interpretation | Returned shape |
|---|---|---|
| lag | Lag | Required. Finite number. |
| precedesEvent | Precedes Event | Required. Boolean. |
{
"input": {
"eventTime": 10,
"publicationTime": 30,
"suppliedClockOffset": 5
},
"output": {
"lag": 15,
"precedesEvent": false
}
}Limitations and assumptions
- The sign and units of the clock offset are caller conventions. No advisory is fetched and timestamp ordering does not establish threat severity, causation, or timeliness obligations.
- The field tables describe structural bounds; the mechanics also state cross-field requirements. Malformed input shapes, disallowed keys, and invalid domains cause input errors. Results must remain finite and within the declared output contract. A successful false flag or zero placeholder is distinct from an error.
- Numeric arithmetic uses binary floating point. Exact comparisons have no hidden tolerance or decimal rounding; negative zero is exported as zero. Decimal-text integer operations retain the exactness specifically stated above.
Alternative or Complementary methods
For advisory publication lag, check the source records and the supplied rule before comparing the result with another method. Use a separate evidence or method review when arithmetic consistency alone cannot establish the required conclusion.
References
Similar or alternative tools
- Advisory Version Order Token
Compare advisory tokens under an explicit order without guessing vendor version semantics.
- Public Advisory Reference Age
Inspect supplied public-advisory provenance dates without fetching alerts or inferring threat levels.