I had a CTI analyst mentee ask me today how to structure a good report about a breach or campaign for technical customers, and my answer was (as always) to model their reports after the outstanding reports from @TheDFIRReport