Re: [cti-cybox] Recent CybOX Changes

[John-Mark Gurney <jmg@newcontext.com>]

Mates, Jeffrey CIV DC3\DCCI wrote this message on Tue, Aug 02, 2016 at 13:45 +0000:
> I don't like the idea of converting strings into an object with the string and encoding since in many cases that information will simply not be present, and when it is present it will be difficult to correctly utilize in this format.
> 
> I could see an analyst being interested in being able to ask a question like, "Get me all PDFs in my system that have character encoding X that were attachments to emails with character encoding Y."

Yeah, this is part of it.. The body of an email needs to be stored in
Unicode (JSON doesn't support anything but), but the original email
body may have been in a different character coding, and this captures
that information...

-- 
John-Mark