Curated entities and incident fields

I programmed the incident’s entities and available Sentinel values to support ServiceNow SecOps mapping tests. The fixture brought identities, devices, ATT&CK tactics and techniques, and labels into the same controlled incident so developers could inspect how each type of context arrived in ServiceNow.