## Summary

Addresses: #166152 for `8.18.1`
and #203370

Updates MITRE ATT&CK mappings to `v16.1`. Last update was to `v15.1` in
#183463.

To update,  I modified 


https://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22

to point to the `ATT&CK-v16.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

## Acceptance Criteria

- [x] User can map and use new MITRE techniques in Security Solution
- [ ] The user-facing documentation is updated with the new version
- [ ] [MITRE ATT&CK®
coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)
page
    - [ ] elastic/security-docs#6797
    - [ ] elastic/docs-content#1292

## Test Criteria

This PR also updates our cypress tests which run with real MITRE data
generated by the same `extract_tactics_techniques_mitre` script. Our
tests would often break when the data was updated to a new version
because the UI elements being tested would cover each other leading to
flakiness or outright test failure. In order to ensure a more streamline
update process the tests should no longer break because of this
flakiness and only when there's a more serious issue.

- [x] Verify that new techniques (see the changelog link above) are
available for mapping on the Rule Creation page under "Advanced
settings"
- [x] Verify that new techniques are available on the MITRE ATT&CK
coverage page

---------

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

)

## Summary

Addresses: elastic#166152 for `8.18.1`
and elastic#203370

Updates MITRE ATT&CK mappings to `v16.1`. Last update was to `v15.1` in
elastic#183463.

To update,  I modified

https://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22

to point to the `ATT&CK-v16.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

## Acceptance Criteria

- [x] User can map and use new MITRE techniques in Security Solution
- [ ] The user-facing documentation is updated with the new version
- [ ] [MITRE ATT&CK®
coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)
page
    - [ ] elastic/security-docs#6797
    - [ ] elastic/docs-content#1292

## Test Criteria

This PR also updates our cypress tests which run with real MITRE data
generated by the same `extract_tactics_techniques_mitre` script. Our
tests would often break when the data was updated to a new version
because the UI elements being tested would cover each other leading to
flakiness or outright test failure. In order to ensure a more streamline
update process the tests should no longer break because of this
flakiness and only when there's a more serious issue.

- [x] Verify that new techniques (see the changelog link above) are
available for mapping on the Rule Creation page under "Advanced
settings"
- [x] Verify that new techniques are available on the MITRE ATT&CK
coverage page

---------

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 203cfc6)

)

## Summary

Addresses: elastic#166152 for `8.18.1`
and elastic#203370

Updates MITRE ATT&CK mappings to `v16.1`. Last update was to `v15.1` in
elastic#183463.

To update,  I modified

https://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22

to point to the `ATT&CK-v16.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

## Acceptance Criteria

- [x] User can map and use new MITRE techniques in Security Solution
- [ ] The user-facing documentation is updated with the new version
- [ ] [MITRE ATT&CK®
coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)
page
    - [ ] elastic/security-docs#6797
    - [ ] elastic/docs-content#1292

## Test Criteria

This PR also updates our cypress tests which run with real MITRE data
generated by the same `extract_tactics_techniques_mitre` script. Our
tests would often break when the data was updated to a new version
because the UI elements being tested would cover each other leading to
flakiness or outright test failure. In order to ensure a more streamline
update process the tests should no longer break because of this
flakiness and only when there's a more serious issue.

- [x] Verify that new techniques (see the changelog link above) are
available for mapping on the Rule Creation page under "Advanced
settings"
- [x] Verify that new techniques are available on the MITRE ATT&CK
coverage page

---------

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 203cfc6)

)

## Summary

Addresses: elastic#166152 for `8.18.1`
and elastic#203370

Updates MITRE ATT&CK mappings to `v16.1`. Last update was to `v15.1` in
elastic#183463.

To update,  I modified

https://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22

to point to the `ATT&CK-v16.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

## Acceptance Criteria

- [x] User can map and use new MITRE techniques in Security Solution
- [ ] The user-facing documentation is updated with the new version
- [ ] [MITRE ATT&CK®
coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)
page
    - [ ] elastic/security-docs#6797
    - [ ] elastic/docs-content#1292

## Test Criteria

This PR also updates our cypress tests which run with real MITRE data
generated by the same `extract_tactics_techniques_mitre` script. Our
tests would often break when the data was updated to a new version
because the UI elements being tested would cover each other leading to
flakiness or outright test failure. In order to ensure a more streamline
update process the tests should no longer break because of this
flakiness and only when there's a more serious issue.

- [x] Verify that new techniques (see the changelog link above) are
available for mapping on the Rule Creation page under "Advanced
settings"
- [x] Verify that new techniques are available on the MITRE ATT&CK
coverage page

---------

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 203cfc6)

…) (#219448)

# Backport

This will backport the following commits from `main` to `9.0`:
- [[Security Solution] Updates kibana MITRE data to `v16.1`
(#215026)](#215026)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"56367316+dplumlee@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-04-28T18:51:36Z","message":"[Security
Solution] Updates kibana MITRE data to `v16.1` (#215026)\n\n##
Summary\n\nAddresses: #166152
for `8.18.1`\nand
https://github.com/elastic/kibana/issues/203370\n\nUpdates MITRE ATT&CK
mappings to `v16.1`. Last update was to `v15.1`
in\nhttps://github.com//pull/183463.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v16.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n## Acceptance Criteria\n\n- [x] User can map
and use new MITRE techniques in Security Solution\n- [ ] The user-facing
documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/security-docs/pull/6797\n - [ ]
https://github.com/elastic/docs-content/pull/1292\n\n## Test
Criteria\n\nThis PR also updates our cypress tests which run with real
MITRE data\ngenerated by the same `extract_tactics_techniques_mitre`
script. Our\ntests would often break when the data was updated to a new
version\nbecause the UI elements being tested would cover each other
leading to\nflakiness or outright test failure. In order to ensure a
more streamline\nupdate process the tests should no longer break because
of this\nflakiness and only when there's a more serious issue.\n\n- [x]
Verify that new techniques (see the changelog link above) are\navailable
for mapping on the Rule Creation page under \"Advanced\nsettings\"\n-
[x] Verify that new techniques are available on the MITRE
ATT&CK\ncoverage page\n\n---------\n\nCo-authored-by: Maxim Palenov
<maxim.palenov@elastic.co>\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"203cfc67ea5be4afdbb969a8ead2f45acd94a702","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","backport:version","Feature:Rule MITRE
ATT&CK®","v9.1.0","v8.19.0","v8.18.1","v9.0.1"],"title":"[Security
Solution] Updates kibana MITRE data to
`v16.1`","number":215026,"url":"https://github.com/elastic/kibana/pull/215026","mergeCommit":{"message":"[Security
Solution] Updates kibana MITRE data to `v16.1` (#215026)\n\n##
Summary\n\nAddresses: #166152
for `8.18.1`\nand
https://github.com/elastic/kibana/issues/203370\n\nUpdates MITRE ATT&CK
mappings to `v16.1`. Last update was to `v15.1`
in\nhttps://github.com//pull/183463.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v16.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n## Acceptance Criteria\n\n- [x] User can map
and use new MITRE techniques in Security Solution\n- [ ] The user-facing
documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/security-docs/pull/6797\n - [ ]
https://github.com/elastic/docs-content/pull/1292\n\n## Test
Criteria\n\nThis PR also updates our cypress tests which run with real
MITRE data\ngenerated by the same `extract_tactics_techniques_mitre`
script. Our\ntests would often break when the data was updated to a new
version\nbecause the UI elements being tested would cover each other
leading to\nflakiness or outright test failure. In order to ensure a
more streamline\nupdate process the tests should no longer break because
of this\nflakiness and only when there's a more serious issue.\n\n- [x]
Verify that new techniques (see the changelog link above) are\navailable
for mapping on the Rule Creation page under \"Advanced\nsettings\"\n-
[x] Verify that new techniques are available on the MITRE
ATT&CK\ncoverage page\n\n---------\n\nCo-authored-by: Maxim Palenov
<maxim.palenov@elastic.co>\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"203cfc67ea5be4afdbb969a8ead2f45acd94a702"}},"sourceBranch":"main","suggestedTargetBranches":["8.19","8.18","9.0"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/215026","number":215026,"mergeCommit":{"message":"[Security
Solution] Updates kibana MITRE data to `v16.1` (#215026)\n\n##
Summary\n\nAddresses: #166152
for `8.18.1`\nand
https://github.com/elastic/kibana/issues/203370\n\nUpdates MITRE ATT&CK
mappings to `v16.1`. Last update was to `v15.1`
in\nhttps://github.com//pull/183463.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v16.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n## Acceptance Criteria\n\n- [x] User can map
and use new MITRE techniques in Security Solution\n- [ ] The user-facing
documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/security-docs/pull/6797\n - [ ]
https://github.com/elastic/docs-content/pull/1292\n\n## Test
Criteria\n\nThis PR also updates our cypress tests which run with real
MITRE data\ngenerated by the same `extract_tactics_techniques_mitre`
script. Our\ntests would often break when the data was updated to a new
version\nbecause the UI elements being tested would cover each other
leading to\nflakiness or outright test failure. In order to ensure a
more streamline\nupdate process the tests should no longer break because
of this\nflakiness and only when there's a more serious issue.\n\n- [x]
Verify that new techniques (see the changelog link above) are\navailable
for mapping on the Rule Creation page under \"Advanced\nsettings\"\n-
[x] Verify that new techniques are available on the MITRE
ATT&CK\ncoverage page\n\n---------\n\nCo-authored-by: Maxim Palenov
<maxim.palenov@elastic.co>\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"203cfc67ea5be4afdbb969a8ead2f45acd94a702"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>
Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

) (#219447)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[Security Solution] Updates kibana MITRE data to `v16.1`
(#215026)](#215026)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"56367316+dplumlee@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-04-28T18:51:36Z","message":"[Security
Solution] Updates kibana MITRE data to `v16.1` (#215026)\n\n##
Summary\n\nAddresses: #166152
for `8.18.1`\nand
https://github.com/elastic/kibana/issues/203370\n\nUpdates MITRE ATT&CK
mappings to `v16.1`. Last update was to `v15.1`
in\nhttps://github.com//pull/183463.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v16.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n## Acceptance Criteria\n\n- [x] User can map
and use new MITRE techniques in Security Solution\n- [ ] The user-facing
documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/security-docs/pull/6797\n - [ ]
https://github.com/elastic/docs-content/pull/1292\n\n## Test
Criteria\n\nThis PR also updates our cypress tests which run with real
MITRE data\ngenerated by the same `extract_tactics_techniques_mitre`
script. Our\ntests would often break when the data was updated to a new
version\nbecause the UI elements being tested would cover each other
leading to\nflakiness or outright test failure. In order to ensure a
more streamline\nupdate process the tests should no longer break because
of this\nflakiness and only when there's a more serious issue.\n\n- [x]
Verify that new techniques (see the changelog link above) are\navailable
for mapping on the Rule Creation page under \"Advanced\nsettings\"\n-
[x] Verify that new techniques are available on the MITRE
ATT&CK\ncoverage page\n\n---------\n\nCo-authored-by: Maxim Palenov
<maxim.palenov@elastic.co>\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"203cfc67ea5be4afdbb969a8ead2f45acd94a702","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","backport:version","Feature:Rule MITRE
ATT&CK®","v9.1.0","v8.19.0","v8.18.1","v9.0.1"],"title":"[Security
Solution] Updates kibana MITRE data to
`v16.1`","number":215026,"url":"https://github.com/elastic/kibana/pull/215026","mergeCommit":{"message":"[Security
Solution] Updates kibana MITRE data to `v16.1` (#215026)\n\n##
Summary\n\nAddresses: #166152
for `8.18.1`\nand
https://github.com/elastic/kibana/issues/203370\n\nUpdates MITRE ATT&CK
mappings to `v16.1`. Last update was to `v15.1`
in\nhttps://github.com//pull/183463.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v16.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n## Acceptance Criteria\n\n- [x] User can map
and use new MITRE techniques in Security Solution\n- [ ] The user-facing
documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/security-docs/pull/6797\n - [ ]
https://github.com/elastic/docs-content/pull/1292\n\n## Test
Criteria\n\nThis PR also updates our cypress tests which run with real
MITRE data\ngenerated by the same `extract_tactics_techniques_mitre`
script. Our\ntests would often break when the data was updated to a new
version\nbecause the UI elements being tested would cover each other
leading to\nflakiness or outright test failure. In order to ensure a
more streamline\nupdate process the tests should no longer break because
of this\nflakiness and only when there's a more serious issue.\n\n- [x]
Verify that new techniques (see the changelog link above) are\navailable
for mapping on the Rule Creation page under \"Advanced\nsettings\"\n-
[x] Verify that new techniques are available on the MITRE
ATT&CK\ncoverage page\n\n---------\n\nCo-authored-by: Maxim Palenov
<maxim.palenov@elastic.co>\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"203cfc67ea5be4afdbb969a8ead2f45acd94a702"}},"sourceBranch":"main","suggestedTargetBranches":["8.19","8.18","9.0"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/215026","number":215026,"mergeCommit":{"message":"[Security
Solution] Updates kibana MITRE data to `v16.1` (#215026)\n\n##
Summary\n\nAddresses: #166152
for `8.18.1`\nand
https://github.com/elastic/kibana/issues/203370\n\nUpdates MITRE ATT&CK
mappings to `v16.1`. Last update was to `v15.1`
in\nhttps://github.com//pull/183463.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v16.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n## Acceptance Criteria\n\n- [x] User can map
and use new MITRE techniques in Security Solution\n- [ ] The user-facing
documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/security-docs/pull/6797\n - [ ]
https://github.com/elastic/docs-content/pull/1292\n\n## Test
Criteria\n\nThis PR also updates our cypress tests which run with real
MITRE data\ngenerated by the same `extract_tactics_techniques_mitre`
script. Our\ntests would often break when the data was updated to a new
version\nbecause the UI elements being tested would cover each other
leading to\nflakiness or outright test failure. In order to ensure a
more streamline\nupdate process the tests should no longer break because
of this\nflakiness and only when there's a more serious issue.\n\n- [x]
Verify that new techniques (see the changelog link above) are\navailable
for mapping on the Rule Creation page under \"Advanced\nsettings\"\n-
[x] Verify that new techniques are available on the MITRE
ATT&CK\ncoverage page\n\n---------\n\nCo-authored-by: Maxim Palenov
<maxim.palenov@elastic.co>\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"203cfc67ea5be4afdbb969a8ead2f45acd94a702"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>
Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

) (#219446)

# Backport

This will backport the following commits from `main` to `8.18`:
- [[Security Solution] Updates kibana MITRE data to `v16.1`
(#215026)](#215026)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Davis
Plumlee","email":"56367316+dplumlee@users.noreply.github.com"},"sourceCommit":{"committedDate":"2025-04-28T18:51:36Z","message":"[Security
Solution] Updates kibana MITRE data to `v16.1` (#215026)\n\n##
Summary\n\nAddresses: #166152
for `8.18.1`\nand
https://github.com/elastic/kibana/issues/203370\n\nUpdates MITRE ATT&CK
mappings to `v16.1`. Last update was to `v15.1`
in\nhttps://github.com//pull/183463.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v16.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n## Acceptance Criteria\n\n- [x] User can map
and use new MITRE techniques in Security Solution\n- [ ] The user-facing
documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/security-docs/pull/6797\n - [ ]
https://github.com/elastic/docs-content/pull/1292\n\n## Test
Criteria\n\nThis PR also updates our cypress tests which run with real
MITRE data\ngenerated by the same `extract_tactics_techniques_mitre`
script. Our\ntests would often break when the data was updated to a new
version\nbecause the UI elements being tested would cover each other
leading to\nflakiness or outright test failure. In order to ensure a
more streamline\nupdate process the tests should no longer break because
of this\nflakiness and only when there's a more serious issue.\n\n- [x]
Verify that new techniques (see the changelog link above) are\navailable
for mapping on the Rule Creation page under \"Advanced\nsettings\"\n-
[x] Verify that new techniques are available on the MITRE
ATT&CK\ncoverage page\n\n---------\n\nCo-authored-by: Maxim Palenov
<maxim.palenov@elastic.co>\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"203cfc67ea5be4afdbb969a8ead2f45acd94a702","branchLabelMapping":{"^v9.1.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Team:Detections
and Resp","Team: SecuritySolution","Team:Detection Rule
Management","backport:version","Feature:Rule MITRE
ATT&CK®","v9.1.0","v8.19.0","v8.18.1","v9.0.1"],"title":"[Security
Solution] Updates kibana MITRE data to
`v16.1`","number":215026,"url":"https://github.com/elastic/kibana/pull/215026","mergeCommit":{"message":"[Security
Solution] Updates kibana MITRE data to `v16.1` (#215026)\n\n##
Summary\n\nAddresses: #166152
for `8.18.1`\nand
https://github.com/elastic/kibana/issues/203370\n\nUpdates MITRE ATT&CK
mappings to `v16.1`. Last update was to `v15.1`
in\nhttps://github.com//pull/183463.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v16.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n## Acceptance Criteria\n\n- [x] User can map
and use new MITRE techniques in Security Solution\n- [ ] The user-facing
documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/security-docs/pull/6797\n - [ ]
https://github.com/elastic/docs-content/pull/1292\n\n## Test
Criteria\n\nThis PR also updates our cypress tests which run with real
MITRE data\ngenerated by the same `extract_tactics_techniques_mitre`
script. Our\ntests would often break when the data was updated to a new
version\nbecause the UI elements being tested would cover each other
leading to\nflakiness or outright test failure. In order to ensure a
more streamline\nupdate process the tests should no longer break because
of this\nflakiness and only when there's a more serious issue.\n\n- [x]
Verify that new techniques (see the changelog link above) are\navailable
for mapping on the Rule Creation page under \"Advanced\nsettings\"\n-
[x] Verify that new techniques are available on the MITRE
ATT&CK\ncoverage page\n\n---------\n\nCo-authored-by: Maxim Palenov
<maxim.palenov@elastic.co>\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"203cfc67ea5be4afdbb969a8ead2f45acd94a702"}},"sourceBranch":"main","suggestedTargetBranches":["8.19","8.18","9.0"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/215026","number":215026,"mergeCommit":{"message":"[Security
Solution] Updates kibana MITRE data to `v16.1` (#215026)\n\n##
Summary\n\nAddresses: #166152
for `8.18.1`\nand
https://github.com/elastic/kibana/issues/203370\n\nUpdates MITRE ATT&CK
mappings to `v16.1`. Last update was to `v15.1`
in\nhttps://github.com//pull/183463.\n\nTo update, I
modified
\n\n\nhttps://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\n\nto
point to the `ATT&CK-v16.1` tag.\n\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\nKibana root
to regen the i18n files.\n\n## Acceptance Criteria\n\n- [x] User can map
and use new MITRE techniques in Security Solution\n- [ ] The user-facing
documentation is updated with the new version\n- [ ] [MITRE
ATT&CK®\ncoverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)\npage\n
- [ ] https://github.com/elastic/security-docs/pull/6797\n - [ ]
https://github.com/elastic/docs-content/pull/1292\n\n## Test
Criteria\n\nThis PR also updates our cypress tests which run with real
MITRE data\ngenerated by the same `extract_tactics_techniques_mitre`
script. Our\ntests would often break when the data was updated to a new
version\nbecause the UI elements being tested would cover each other
leading to\nflakiness or outright test failure. In order to ensure a
more streamline\nupdate process the tests should no longer break because
of this\nflakiness and only when there's a more serious issue.\n\n- [x]
Verify that new techniques (see the changelog link above) are\navailable
for mapping on the Rule Creation page under \"Advanced\nsettings\"\n-
[x] Verify that new techniques are available on the MITRE
ATT&CK\ncoverage page\n\n---------\n\nCo-authored-by: Maxim Palenov
<maxim.palenov@elastic.co>\nCo-authored-by: Elastic Machine
<elasticmachine@users.noreply.github.com>","sha":"203cfc67ea5be4afdbb969a8ead2f45acd94a702"}},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.18","label":"v8.18.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Davis Plumlee <56367316+dplumlee@users.noreply.github.com>
Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>

)

## Summary

Addresses: elastic#166152 for `8.18.1`
and elastic#203370

Updates MITRE ATT&CK mappings to `v16.1`. Last update was to `v15.1` in
elastic#183463.

To update,  I modified 


https://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22

to point to the `ATT&CK-v16.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

## Acceptance Criteria

- [x] User can map and use new MITRE techniques in Security Solution
- [ ] The user-facing documentation is updated with the new version
- [ ] [MITRE ATT&CK®
coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)
page
    - [ ] elastic/security-docs#6797
    - [ ] elastic/docs-content#1292

## Test Criteria

This PR also updates our cypress tests which run with real MITRE data
generated by the same `extract_tactics_techniques_mitre` script. Our
tests would often break when the data was updated to a new version
because the UI elements being tested would cover each other leading to
flakiness or outright test failure. In order to ensure a more streamline
update process the tests should no longer break because of this
flakiness and only when there's a more serious issue.

- [x] Verify that new techniques (see the changelog link above) are
available for mapping on the Rule Creation page under "Advanced
settings"
- [x] Verify that new techniques are available on the MITRE ATT&CK
coverage page

---------

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>