A SOC analyst receives 300 suspicious email attachments per day and cannot manually examine each one. The team wants to rapidly filter samples so that only unknown or ambiguous ones are escalated for deeper analysis. According to the standard malware analysis process, which stage should be applied FIRST to triage this high volume of samples with minimal analyst effort?