17faa01103
Adds device/IOC/process enrichment, host groups, cases, RTR scripts/files/responders, ML/IOA exclusions, quarantine, Spotlight/CVE, ODS scans, CSPM, users, IOA rules, CNAPP, detection resolve, workflows, and identity (GraphQL). OAuth2 client-credentials, code-first scripts. Excludes XSOAR-only plumbing (fetch/mirroring), deprecated legacy commands, and binary/long-poll flows (retrieve-file, ngsiem search). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>