Implementing Extended Thinking for Alert Correlation

Enhance your Claude agent to perform multi-step extended thinking when triaging alerts. Instead of direct classification, the agent should first hypothesize potential causes, then use tools to gather evidence, and finally deduce the actual threat. The `reasoning_path` in the output should reflect these steps. Introduce a new tool, `get_process_hash(process_name: str)`, which simulates getting a hash to feed into `threat_intel_lookup`. Consider how to guide Claude Opus 4.1 to articulate its thought process effectively.

Think about how the agent would decide *when* to use each tool in its reasoning flow.