Think about adding support for characterizing 'interesting' data

[ikiril01]

We should think about whether/how we can add support for characterizing/tagging interesting bits of analysis, e.g. particular actions, objects, etc.

[ikiril01]

Perhaps this can be achieved by a simple entity reference and corresponding tag (either free-form or from an enumeration):

<Observation type="malformed header value" target_id="pefile-object-1"/>

One of the other open questions is where it most make sense to store this - as an element under a Malware Subject, or inside of one of its Analyses?

[ikiril01]

Regarding the previous question, my inclination is to include Observations at the Analysis level, given that they're quite similar to analyst Comments (also included in the Analysis).