FW: Suspicious Activity Object

It seems I was sending these emails to the wrong distro, hopefully this
works this time.  Interested in everyone's thoughts


Below is a link to the Suspicious Activity Object proposal.  As requested I
updated the object to use the embedded reference, similar to the Malware
proposal rather than using a relationship.  Comments welcome.  

https://docs.google.com/document/d/1I5Cgqfk1Krt9EnYJZcyTLS3c5BtZ5uqvTDXI_i7O
JrU/edit?usp=sharing