Attach additional information to samples in a generic way

[fabian-marquardt]

Some thoughts:

• IPs, Domains, URIs can already be used, but this is not flexible enough for e.g. Botnet analysis
• Not covered at all: ports
• Not really covered: Malware might change used endpoints (DGAs etc.)
• Can we come up with a more generic approach?
• How to organize the data? Which relations are needed?

[fabian-marquardt]

Result of today's phone call:

• IP, Domain and URI samples should be unchanged for compatibility and to uphold the differentiation of the types of information which are covered by these types
• Creating samples e.g. for each IP and port would result in increased data duplication, maintenance of references is difficult
• Idea: Create a new model to hold a specific "sample information" which can be attached to samples, i.e. a sample information about activity on a specific port will be attached to the IP sample
• @tbehner will consult with the affected users to find out if this solution is acceptable