Malware operations is about events/activities relating to 'scan', 'AV updates', scan started, scan completed etc.. that are not related to detecting an attack [ e.g. virus/malware/threat detected - they usually have a signature]. These events are to have tags : Malware, Operations as per data models.
