A malware analyst who has completed static and dynamic analysis of a malware sample needs to translate their raw technical notes, disassembler observations, sandbox reports, and YARA/Sigma rule drafts into a structured triage report that communicates findings to both the SOC (for detection) and the threat intelligence team (for actor attribution and campaign tracking).