There is an example notes files included in the documents directory, documents/Notes.txt. You can copy that file to the workspace directory prior to each engagement and log all of your adhoc notes and observations there.

It is important that you include datetime stamps for each entry. Under the Edit tab in the Pluma editor there is an option to insert the current datetime stamp. It is best to begin each item being noted with a datetime stamp.

This will allow you to accurately correlate your activity to events that occur on the network weither related or not. It also allows you to identify specific portions of the tcpdump pcap log file that recorded all of your network activity.