Re: [cti] CybOX Datatype Refactoring/Deprecation

["Jason Keirstead" <Jason.Keirstead@ca.ibm.com>]

I understand the encoding one, but not the obfuscated one. If someone wants to obfuscate (either reversibly or irreversibly) an email or URL before publishing it, we can't prevent that. I am not sure what is meant by "support" in this case.
-
Jason Keirstead
STSM, Product Architect, Security Intelligence, IBM Security Systems
www.ibm.com/security | www.securityintelligence.com

Without data, all you are is just another person with an opinion - Unknown


"Kirillov, Ivan A." ---03/22/2016 11:29:07 AM---Now that we’ve voted to not support defanging, the question remains as to whether we should support

From: "Kirillov, Ivan A." <ikirillov@mitre.org>
To: "'cti@lists.oasis-open.org'" <cti@lists.oasis-open.org>
Date: 03/22/2016 11:29 AM
Subject: Re: [cti] CybOX Datatype Refactoring/Deprecation
Sent by: <cti@lists.oasis-open.org>

---

Now that we’ve voted to not support defanging, the question remains as to whether we should support obfuscation and capture of observed encoding on CybOX Object fields:

• Obfuscation example: XXXX@yahoo.com or YYYY@comcast.com. Also used for URLs.
• Observed encoding: utf-8, etc. Mostly relevant for malware analysis and attribution, e.g., if an actor is known to use a particular encoding in their comment strings.

Regards,
Ivan