Root Analysis

The root analysis object is the root of all analysis and thus the root of all parent-child relationships. A root analysis is an analysis object. Thus is can contain zero or more observables and zero or more tags.

During analysis by an engine the root analysis is always available by reference to the analysis modules.

A root analysis can automically become an alert if one or more detection points are added during the course of analysis.

An alert is also considered a root analysis object.