Skip to content

[8.19] [Security Solution] Updates kibana MITRE data to v17.1 (#231375)#233793

Merged
dplumlee merged 1 commit intoelastic:8.19from
dplumlee:backport/8.19/pr-231375
Sep 3, 2025
Merged

[8.19] [Security Solution] Updates kibana MITRE data to v17.1 (#231375)#233793
dplumlee merged 1 commit intoelastic:8.19from
dplumlee:backport/8.19/pr-231375

Conversation

@dplumlee
Copy link
Copy Markdown
Contributor

@dplumlee dplumlee commented Sep 2, 2025

Backport

This will backport the following commits from main to 8.19:

Questions ?

Please refer to the Backport tool documentation

)

## Summary

Addresses: elastic#166152 for `9.2.0`

Updates MITRE ATT&CK mappings to `v17.1`. Last update was to `v16.1` in
elastic#215026.

To update,  I modified

https://github.com/elastic/kibana/blob/1d54622d8318295d9d0509b34c1b36c811a2382e/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22

to point to the `ATT&CK-v17.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

### Note

This PR also adds guards to the test generation script so that it
prevents duplicate data being generated and causing tests breaking after
running this script. Another step in hopefully making this data
generation and related testing entirely automated.

## Acceptance Criteria

- [x] User can map and use new MITRE techniques in Security Solution
- [ ] The user-facing documentation is updated with the new version
- [ ] [MITRE ATT&CK®
coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html)
page
    - [ ] elastic/docs-content#2518

## Test Criteria

- [x] Verify that new techniques (see the changelog link above) are
available for mapping on the Rule Creation page under "Advanced
settings"
- [x] Verify that new techniques are available on the MITRE ATT&CK
coverage page

---------

Co-authored-by: kibanamachine <42973632+kibanamachine@users.noreply.github.com>
(cherry picked from commit 1f33388)

# Conflicts:
#	x-pack/platform/plugins/private/translations/translations/de-DE.json
@dplumlee dplumlee added the backport This PR is a backport of another PR label Sep 2, 2025
@dplumlee dplumlee enabled auto-merge (squash) September 2, 2025 20:29
@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 9.4MB 9.4MB +7.4KB

@dplumlee dplumlee merged commit 6164c89 into elastic:8.19 Sep 3, 2025
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants