Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution][Detections] Updates MITRE ATT&CK mappings to v12.1 #151931

Merged
merged 2 commits into from
Feb 23, 2023
Merged

[Security Solution][Detections] Updates MITRE ATT&CK mappings to v12.1 #151931

merged 2 commits into from
Feb 23, 2023

Conversation

spong
Copy link
Member

@spong spong commented Feb 22, 2023 •
edited by kibanamachine
Loading

Summary

Updates MITRE ATT&CK mappings to v12.1, see detection-rules repo update here: elastic/detection-rules#2422. Last update was to v11.3 in #137122.

To update, I modified

kibana/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js

Line 22 in 1a19148

const MITRE_CONTENT_VERSION = 'ATT&CK-v11.3'; // last updated when preparing for 8.4.0 release

to point to the ATT&CK-v12.1 tag.

Then ran yarn extract-mitre-attacks from the root security_solution plugin directory, and then node scripts/i18n_check.js --fix from Kibana root to regen the i18n files.

Checklist

@spong spong added release_note:enhancement Feature:Detection Rules Security Solution rules and Detection Engine Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team v8.7.0 v8.8.0 labels Feb 22, 2023
@spong spong self-assigned this Feb 22, 2023
@spong spong requested review from a team as code owners February 22, 2023 19:39
@spong spong requested a review from xcrzx February 22, 2023 19:39
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@spong spong added the v8.6.0 label Feb 22, 2023
@kibana-ci
Copy link
Collaborator

💛 Build succeeded, but was flaky

Failed CI Steps

Test Failures

  • [job] [logs] FTR Configs #59 / console app XJSON inline http request should have method and path

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id before after diff
securitySolution 13.8MB 13.9MB +110.6KB

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @spong

xcrzx
xcrzx approved these changes Feb 23, 2023
View reviewed changes
Copy link
Contributor

@xcrzx xcrzx left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

@spong spong merged commit bbfa43a into elastic:main Feb 23, 2023
@spong spong deleted the update-mitre-v12.1 branch February 23, 2023 15:26
@kibanamachine kibanamachine mentioned this pull request Feb 23, 2023
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 23, 2023
@spong
[Security Solution][Detections] Updates MITRE ATT&CK mappings to v12.1 (
6a10c40 
elastic#151931)

## Summary

Updates MITRE ATT&CK mappings to `v12.1`, see `detection-rules` repo
update here: elastic/detection-rules#2422. Last
update was to `v11.3` in elastic#137122.

To update,  I modified

https://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22
to point to the `ATT&CK-v12.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

### Checklist

- [X] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)

(cherry picked from commit bbfa43a)
@kibanamachine kibanamachine mentioned this pull request Feb 23, 2023
Merged
kibanamachine pushed a commit to kibanamachine/kibana that referenced this pull request Feb 23, 2023
@spong
[Security Solution][Detections] Updates MITRE ATT&CK mappings to v12.1 (
7623898 
elastic#151931)

## Summary

Updates MITRE ATT&CK mappings to `v12.1`, see `detection-rules` repo
update here: elastic/detection-rules#2422. Last
update was to `v11.3` in elastic#137122.

To update,  I modified

https://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22
to point to the `ATT&CK-v12.1` tag.

Then ran `yarn extract-mitre-attacks` from the root `security_solution`
plugin directory, and then `node scripts/i18n_check.js --fix` from
Kibana root to regen the i18n files.

### Checklist

- [X] Any text added follows [EUI's writing
guidelines](https://elastic.github.io/eui/#/guidelines/writing), uses
sentence case text and includes [i18n
support](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)

(cherry picked from commit bbfa43a)
@kibanamachine
Copy link
Contributor

💚 All backports created successfully

Status Branch Result
✅ 8.6
✅ 8.7

Note: Successful backport PRs will be merged automatically after passing CI.

Questions ?

Please refer to the Backport tool documentation

kibanamachine added a commit that referenced this pull request Feb 23, 2023
@kibanamachine @spong
[8.6] [Security Solution][Detections] Updates MITRE ATT&CK mappings t…
27c9742 
…o v12.1 (#151931) (#152006)

# Backport

This will backport the following commits from `main` to `8.6`:
- [[Security Solution][Detections] Updates MITRE ATT&CK mappings to
v12.1 (#151931)](#151931)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Garrett
Spong","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-02-23T15:26:00Z","message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba","branchLabelMapping":{"^v8.8.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Feature:Detection
Rules","Team:Detections and Resp","Team:
SecuritySolution","Team:Detection
Rules","v8.6.0","v8.7.0","v8.8.0"],"number":151931,"url":"https://github.com/elastic/kibana/pull/151931","mergeCommit":{"message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba"}},"sourceBranch":"main","suggestedTargetBranches":["8.6","8.7"],"targetPullRequestStates":[{"branch":"8.6","label":"v8.6.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.7","label":"v8.7.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.8.0","labelRegex":"^v8.8.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/151931","number":151931,"mergeCommit":{"message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba"}}]}]
BACKPORT-->

Co-authored-by: Garrett Spong <[email protected]>
@kibanamachine kibanamachine mentioned this pull request Feb 23, 2023
Merged
kibanamachine added a commit that referenced this pull request Feb 23, 2023
@kibanamachine @spong
[8.7] [Security Solution][Detections] Updates MITRE ATT&CK mappings t…
7114fb6 
…o v12.1 (#151931) (#152007)

# Backport

This will backport the following commits from `main` to `8.7`:
- [[Security Solution][Detections] Updates MITRE ATT&CK mappings to
v12.1 (#151931)](#151931)

<!--- Backport version: 8.9.7 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Garrett
Spong","email":"[email protected]"},"sourceCommit":{"committedDate":"2023-02-23T15:26:00Z","message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba","branchLabelMapping":{"^v8.8.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:enhancement","Feature:Detection
Rules","Team:Detections and Resp","Team:
SecuritySolution","Team:Detection
Rules","v8.6.0","v8.7.0","v8.8.0"],"number":151931,"url":"https://github.com/elastic/kibana/pull/151931","mergeCommit":{"message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba"}},"sourceBranch":"main","suggestedTargetBranches":["8.6","8.7"],"targetPullRequestStates":[{"branch":"8.6","label":"v8.6.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.7","label":"v8.7.0","labelRegex":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v8.8.0","labelRegex":"^v8.8.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/151931","number":151931,"mergeCommit":{"message":"[Security
Solution][Detections] Updates MITRE ATT&CK mappings to v12.1
(#151931)\n\n## Summary\r\n\r\nUpdates MITRE ATT&CK mappings to `v12.1`,
see `detection-rules` repo\r\nupdate here:
elastic/detection-rules#2422. Last\r\nupdate was
to `v11.3` in https://github.com/elastic/kibana/pull/137122.\r\n\r\nTo
update, I modified
\r\n\r\n\r\nhttps://github.com/elastic/kibana/blob/1a19148c1818b9af3b7735a0b6001bbb6bd8d7ba/x-pack/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22\r\nto
point to the `ATT&CK-v12.1` tag.\r\n\r\nThen ran `yarn
extract-mitre-attacks` from the root `security_solution`\r\nplugin
directory, and then `node scripts/i18n_check.js --fix` from\r\nKibana
root to regen the i18n files.\r\n\r\n### Checklist\r\n\r\n- [X] Any text
added follows [EUI's
writing\r\nguidelines](https://elastic.github.io/eui/#/guidelines/writing),
uses\r\nsentence case text and includes
[i18n\r\nsupport](https://github.com/elastic/kibana/blob/master/packages/kbn-i18n/README.md)","sha":"bbfa43ae58f9d2d94a124b932a26cdd6e8167aba"}}]}]
BACKPORT-->

Co-authored-by: Garrett Spong <[email protected]>
@dplumlee dplumlee mentioned this pull request Sep 7, 2023
Merged
@banderror banderror mentioned this pull request Sep 12, 2023
Open
6 tasks
@dplumlee dplumlee mentioned this pull request Sep 14, 2023
Merged
5 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@xcrzx xcrzx xcrzx approved these changes

Assignees

@spong spong

Labels
Feature:Detection Rules Security Solution rules and Detection Engine release_note:enhancement Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. v8.6.0 v8.6.3 v8.7.0 v8.8.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@spong @elasticmachine @kibana-ci @kibanamachine @xcrzx