Skip to content

[9.0] [Security Solution] Updates kibana MITRE data to v16.1 (#215026)#219448

Merged
kibanamachine merged 1 commit intoelastic:9.0from
kibanamachine:backport/9.0/pr-215026
Apr 28, 2025
Merged

[9.0] [Security Solution] Updates kibana MITRE data to v16.1 (#215026)#219448
kibanamachine merged 1 commit intoelastic:9.0from
kibanamachine:backport/9.0/pr-215026

Conversation

@kibanamachine
Copy link
Copy Markdown
Contributor

Backport

This will backport the following commits from main to 9.0:

Questions ?

Please refer to the Backport tool documentation

)

## Summary

Addresses: elastic#166152 for `8.18.1`
and elastic#203370

Updates MITRE ATT&CK mappings to `v16.1`. Last update was to `v15.1` in
elastic#183463.

To update,  I modified

https://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22

to point to the `ATT&CK-v16.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

## Acceptance Criteria

- [x] User can map and use new MITRE techniques in Security Solution
- [ ] The user-facing documentation is updated with the new version
- [ ] [MITRE ATT&CK®
coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)
page
    - [ ] elastic/security-docs#6797
    - [ ] elastic/docs-content#1292

## Test Criteria

This PR also updates our cypress tests which run with real MITRE data
generated by the same `extract_tactics_techniques_mitre` script. Our
tests would often break when the data was updated to a new version
because the UI elements being tested would cover each other leading to
flakiness or outright test failure. In order to ensure a more streamline
update process the tests should no longer break because of this
flakiness and only when there's a more serious issue.

- [x] Verify that new techniques (see the changelog link above) are
available for mapping on the Rule Creation page under "Advanced
settings"
- [x] Verify that new techniques are available on the MITRE ATT&CK
coverage page

---------

Co-authored-by: Maxim Palenov <maxim.palenov@elastic.co>
Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
(cherry picked from commit 203cfc6)
@kibanamachine kibanamachine added the backport This PR is a backport of another PR label Apr 28, 2025
@kibanamachine kibanamachine enabled auto-merge (squash) April 28, 2025 18:58
@kibanamachine kibanamachine merged commit c049caa into elastic:9.0 Apr 28, 2025
12 checks passed
@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 8.8MB 8.8MB +6.7KB

cc @dplumlee

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants