Built from the published OpenAPI spec for mock instance s1 (type: edr).
Incident ingestion (list_incidents) with since/after_id paging and an OCSF
mapper + 'Mock EDR Incident' default type, plus an acknowledge/resolve/dismiss
incident action. X-API-Key auth; the instance path segment is configurable.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Guillaume BOURGEOIS