Preserve context that analysts need to act

I defined requirements for affected users, observables, ATT&CK mappings and operational labels across Sentinel, ServiceNow SIR and XSOAR. Labels carry escalation, automation, suppression, linking and test context. Those meanings need to survive the integration alongside status and closure.