Absence of is_read Attribute in Email Object

[nkaras]

We are in the process of translating security events to OCSF events. We have noticed the Email object doesn't include an is_read attribute to indicate whether an email has been read. This attribute is commonly used in email security systems.

Could you please clarify the rationale behind its omission? Specifically:

• Was the exclusion of is_read intentional, perhaps due to certain design principles?
• Is there a recommended approach within the OCSF framework to represent the read status of an email?
• Are there plans to incorporate this attribute in future schema versions?

[rickmode]

Most likely, no one has had a need for this attribute. I don't see an issue with adding this.

I suggest creating a PR adding this as an Optional attribute. The core maintainers will probably add it with minimal comment. From there it's a matter of waiting until this makes it in to the next released version.

If you need help with this, I can guide you or create the PR on your behalf.

[nkaras]

Thanks for the suggestion. I'll create a PR and reach out if I need any assistance.

[nkaras]

#1406