IDMEF vs IODEF: (4)
6. IDMEF uses detectTime/IDMEF.
The DetectTime class is used to indicate the date and time the event(s) producing an alert was detected by the analyzer. In the case of more than one event, the time the first event was detected.
(This may or may not be the same time as CreateTime; analyzers are not required to send alerts immediately upon detection).
The DetectTime class has one attribute: ntpstamp representing the same date and time as the element content.
Consider including element registrationTime/IODEF