Analyze whether a candidate firewall rule overlaps with an existing ruleset. Detects exact duplicates, shadowed rules, action conflicts, and partial overlaps. Two input modes: (1) vendor-native configs via vendor + ruleset_payload + candidate_rule_payload, or (2) pre-normalized JSON via existing_rules + candidate_rule. Use parse_policy first to inspect parser output before analysis.

Parse a vendor-native firewall config and return normalized JSON rules. Use this to inspect what the built-in parser extracts — verify rule counts, object resolution, and address expansion before running overlap analysis. The output uses the same normalized schema accepted by analyze_firewall_rule_overlap.

Analyze multiple candidate rules against the same existing ruleset in a single call. More efficient than calling analyze_firewall_rule_overlap multiple times — existing_rules is parsed once and reused for each candidate. Use parse_policy first to get normalized rules, then pass all candidates at once.

List all supported firewall vendors and their configuration format requirements. Use this to understand what vendor identifiers and payload formats are accepted by analyze_firewall_rule_overlap and parse_policy.