2 Commits

Author	SHA1	Message	Date
Guillaume BOURGEOIS	b99de4af19	fix(mock-edr-s1): map the OCSF-shaped incident payload ... The mock now emits incidents already in an OCSF-aligned shape (src_endpoint, device, user, rule, dst_endpoint, dns_query, cloud, metadata). Map those nested fields through to OCSF instead of only the flat OpenAPI fields. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-27 16:20:53 +02:00
Guillaume BOURGEOIS	7e96048446	feat(mock-edr-s1): EDR incident integration from OpenAPI spec ... Built from the published OpenAPI spec for mock instance s1 (type: edr). Incident ingestion (list_incidents) with since/after_id paging and an OCSF mapper + 'Mock EDR Incident' default type, plus an acknowledge/resolve/dismiss incident action. X-API-Key auth; the instance path segment is configurable. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-27 16:00:04 +02:00