Incident meaning across platforms

A Sentinel incident contains entities and investigation context that need explicit mappings into ServiceNow SIR and the XSOAR workflow. I clarified affected-user, observable and ATT&CK requirements, together with labels used for escalation, automation, suppression, linking and testing. Closure classifications also needed agreed meanings across the platforms.