We should consider adding basic provenance data to the Malware Instance object, such as when it was first seen.