Skip to content

[Security Solution][Detections] Updates MITRE ATT&CK mappings to v12.1#151931

Merged
spong merged 2 commits intoelastic:mainfrom
spong:update-mitre-v12.1
Feb 23, 2023
Merged

[Security Solution][Detections] Updates MITRE ATT&CK mappings to v12.1#151931
spong merged 2 commits intoelastic:mainfrom
spong:update-mitre-v12.1

Conversation

@spong
Copy link
Copy Markdown
Member

@spong spong commented Feb 22, 2023 •
edited by kibanamachine
Loading

Summary

Updates MITRE ATT&CK mappings to v12.1, see detection-rules repo update here: elastic/detection-rules#2422. Last update was to v11.3 in #137122.

To update, I modified

kibana/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js

Line 22 in 1a19148

const MITRE_CONTENT_VERSION = 'ATT&CK-v11.3'; // last updated when preparing for 8.4.0 release

to point to the ATT&CK-v12.1 tag.

Then ran yarn extract-mitre-attacks from the root security_solution plugin directory, and then node scripts/i18n_check.js --fix from Kibana root to regen the i18n files.

Checklist

@spong spong added release_note:enhancement Feature:Detection Rules Security Solution rules and Detection Engine Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team v8.7.0 v8.8.0 labels Feb 22, 2023
@spong spong self-assigned this Feb 22, 2023
@spong spong requested review from a team as code owners February 22, 2023 19:39
@spong spong requested a review from xcrzx February 22, 2023 19:39
@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Feb 22, 2023

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Copy Markdown
Contributor

elasticmachine commented Feb 22, 2023

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@spong spong added the v8.6.0 label Feb 22, 2023
@kibana-ci
Copy link
Copy Markdown

kibana-ci commented Feb 22, 2023

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #59 / console app XJSON inline http request should have method and path

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 13.8MB 13.9MB +110.6KB

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @spong

xcrzx
xcrzx approved these changes Feb 23, 2023
View reviewed changes
Copy link
Copy Markdown
Contributor

@xcrzx xcrzx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@spong spong merged commit bbfa43a into elastic:main Feb 23, 2023
@spong spong deleted the update-mitre-v12.1 branch February 23, 2023 15:26
@kibanamachine kibanamachine mentioned this pull request Feb 23, 2023
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 23, 2023
@spong
[Security Solution][Detections] Updates MITRE ATT&CK mappings to v12.1 (
6a10c40 
elastic#151931)

## Summary

Updates MITRE ATT&CK mappings to `v12.1`, see `detection-rules` repo
update here: elastic/detection-rules#2422. Last
update was to `v11.3` in elastic#137122.

To update,  I modified

https://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22
to point to the `ATT&CK-v12.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

### Checklist

- [X] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)

(cherry picked from commit bbfa43a)
@kibanamachine kibanamachine mentioned this pull request Feb 23, 2023
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 23, 2023
@spong
[Security Solution][Detections] Updates MITRE ATT&CK mappings to v12.1 (
7623898 
elastic#151931)

## Summary

Updates MITRE ATT&CK mappings to `v12.1`, see `detection-rules` repo
update here: elastic/detection-rules#2422. Last
update was to `v11.3` in elastic#137122.

To update,  I modified

https://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22
to point to the `ATT&CK-v12.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

### Checklist

- [X] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)

(cherry picked from commit bbfa43a)
@kibanamachine
Copy link
Copy Markdown
Contributor

kibanamachine commented Feb 23, 2023

💚 All backports created successfully

Status Branch Result
✅ 8.6
✅ 8.7

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Feb 23, 2023
@kibanamachine @spong
[8.6] [Security Solution][Detections] Updates MITRE ATT&CK mappings t…
27c9742 
…o v12.1 (#151931) (#152006)

# Backport

This will backport the following commits from `main` to `8.6`:
- [[Security Solution][Detections] Updates MITRE ATT&CK mappings to
v12.1 (#151931)](#151931)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Garrett
Spong","email":"spong@users.noreply.github.com"},"sourceCommit":{"committedDate":"2023-02-23T15:26:00Z","message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba","branchLabelMapping":{"^v8.8.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Feature:Detection
Rules","Team:Detections and Resp","Team:
SecuritySolution","Team:Detection
Rules","v8.6.0","v8.7.0","v8.8.0"],"number":151931,"url":"https://github.com/elastic/kibana/pull/151931","mergeCommit":{"message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba"}},"sourceBranch":"main","suggestedTargetBranches":["8.6","8.7"],"targetPullRequestStates":[{"branch":"8.6","label":"v8.6.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.7","label":"v8.7.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.8.0","labelRegex":"^v8.8.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/151931","number":151931,"mergeCommit":{"message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba"}}]}]
BACKPORT-->

Co-authored-by: Garrett Spong <spong@users.noreply.github.com>
@kibanamachine kibanamachine mentioned this pull request Feb 23, 2023
Merged
kibanamachine added a commit that referenced this pull request Feb 23, 2023
@kibanamachine @spong
[8.7] [Security Solution][Detections] Updates MITRE ATT&CK mappings t…
7114fb6 
…o v12.1 (#151931) (#152007)

# Backport

This will backport the following commits from `main` to `8.7`:
- [[Security Solution][Detections] Updates MITRE ATT&CK mappings to
v12.1 (#151931)](#151931)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Garrett
Spong","email":"spong@users.noreply.github.com"},"sourceCommit":{"committedDate":"2023-02-23T15:26:00Z","message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba","branchLabelMapping":{"^v8.8.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Feature:Detection
Rules","Team:Detections and Resp","Team:
SecuritySolution","Team:Detection
Rules","v8.6.0","v8.7.0","v8.8.0"],"number":151931,"url":"https://github.com/elastic/kibana/pull/151931","mergeCommit":{"message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba"}},"sourceBranch":"main","suggestedTargetBranches":["8.6","8.7"],"targetPullRequestStates":[{"branch":"8.6","label":"v8.6.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.7","label":"v8.7.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.8.0","labelRegex":"^v8.8.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/151931","number":151931,"mergeCommit":{"message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba"}}]}]
BACKPORT-->

Co-authored-by: Garrett Spong <spong@users.noreply.github.com>
@dplumlee dplumlee mentioned this pull request Sep 7, 2023
Merged
@banderror banderror mentioned this pull request Sep 12, 2023
Open
@dplumlee dplumlee mentioned this pull request Sep 14, 2023
Merged
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer

@xcrzx xcrzx xcrzx approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

@spong spong

Labels

Feature:Detection Rules Security Solution rules and Detection Engine release_note:enhancement Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.6.0 v8.6.3 v8.7.0 v8.8.0

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@spong @elasticmachine @kibana-ci @kibanamachine @xcrzx