Skip to content

Commit 58a5143

Browse files
shashank-elasticshashank-elastic
authored
December Schema Refresh (#5420)
1 parent 8c5231e commit 58a5143

File tree

89 files changed

+419
-54
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

89 files changed

+419
-54
lines changed

‎detection_rules/etc/api_schemas/master/master.base.json‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@
188188
},
189189
"risk_score": {
190190
"maximum": 100,
191-
"minimum": 1,
191+
"minimum": 0,
192192
"type": "integer"
193193
},
194194
"risk_score_mapping": {
@@ -296,8 +296,10 @@
296296
"properties": {
297297
"framework": {
298298
"enum": [
299-
"MITRE ATT&CK"
299+
"MITRE ATT&CK",
300+
"MITRE ATLAS"
300301
],
302+
"enumNames": [],
301303
"type": "string"
302304
},
303305
"tactic": {
@@ -310,7 +312,7 @@
310312
"type": "string"
311313
},
312314
"reference": {
313-
"pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
315+
"pattern": "^(https://attack.mitre.org/tactics/TA[0-9]+/|https://atlas.mitre.org/tactics/AML\\.TA[0-9]+/)$",
314316
"type": "string"
315317
}
316318
},
@@ -331,7 +333,7 @@
331333
"type": "string"
332334
},
333335
"reference": {
334-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
336+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+/)$",
335337
"type": "string"
336338
},
337339
"subtechnique": {
@@ -345,7 +347,7 @@
345347
"type": "string"
346348
},
347349
"reference": {
348-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
350+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+\\.[0-9]+/)$",
349351
"type": "string"
350352
}
351353
},

‎detection_rules/etc/api_schemas/master/master.eql.json‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -261,7 +261,7 @@
261261
},
262262
"risk_score": {
263263
"maximum": 100,
264-
"minimum": 1,
264+
"minimum": 0,
265265
"type": "integer"
266266
},
267267
"risk_score_mapping": {
@@ -369,8 +369,10 @@
369369
"properties": {
370370
"framework": {
371371
"enum": [
372-
"MITRE ATT&CK"
372+
"MITRE ATT&CK",
373+
"MITRE ATLAS"
373374
],
375+
"enumNames": [],
374376
"type": "string"
375377
},
376378
"tactic": {
@@ -383,7 +385,7 @@
383385
"type": "string"
384386
},
385387
"reference": {
386-
"pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
388+
"pattern": "^(https://attack.mitre.org/tactics/TA[0-9]+/|https://atlas.mitre.org/tactics/AML\\.TA[0-9]+/)$",
387389
"type": "string"
388390
}
389391
},
@@ -404,7 +406,7 @@
404406
"type": "string"
405407
},
406408
"reference": {
407-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
409+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+/)$",
408410
"type": "string"
409411
},
410412
"subtechnique": {
@@ -418,7 +420,7 @@
418420
"type": "string"
419421
},
420422
"reference": {
421-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
423+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+\\.[0-9]+/)$",
422424
"type": "string"
423425
}
424426
},

‎detection_rules/etc/api_schemas/master/master.esql.json‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,7 @@
255255
},
256256
"risk_score": {
257257
"maximum": 100,
258-
"minimum": 1,
258+
"minimum": 0,
259259
"type": "integer"
260260
},
261261
"risk_score_mapping": {
@@ -363,8 +363,10 @@
363363
"properties": {
364364
"framework": {
365365
"enum": [
366-
"MITRE ATT&CK"
366+
"MITRE ATT&CK",
367+
"MITRE ATLAS"
367368
],
369+
"enumNames": [],
368370
"type": "string"
369371
},
370372
"tactic": {
@@ -377,7 +379,7 @@
377379
"type": "string"
378380
},
379381
"reference": {
380-
"pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
382+
"pattern": "^(https://attack.mitre.org/tactics/TA[0-9]+/|https://atlas.mitre.org/tactics/AML\\.TA[0-9]+/)$",
381383
"type": "string"
382384
}
383385
},
@@ -398,7 +400,7 @@
398400
"type": "string"
399401
},
400402
"reference": {
401-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
403+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+/)$",
402404
"type": "string"
403405
},
404406
"subtechnique": {
@@ -412,7 +414,7 @@
412414
"type": "string"
413415
},
414416
"reference": {
415-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
417+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+\\.[0-9]+/)$",
416418
"type": "string"
417419
}
418420
},

‎detection_rules/etc/api_schemas/master/master.machine_learning.json‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,7 @@
249249
},
250250
"risk_score": {
251251
"maximum": 100,
252-
"minimum": 1,
252+
"minimum": 0,
253253
"type": "integer"
254254
},
255255
"risk_score_mapping": {
@@ -357,8 +357,10 @@
357357
"properties": {
358358
"framework": {
359359
"enum": [
360-
"MITRE ATT&CK"
360+
"MITRE ATT&CK",
361+
"MITRE ATLAS"
361362
],
363+
"enumNames": [],
362364
"type": "string"
363365
},
364366
"tactic": {
@@ -371,7 +373,7 @@
371373
"type": "string"
372374
},
373375
"reference": {
374-
"pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
376+
"pattern": "^(https://attack.mitre.org/tactics/TA[0-9]+/|https://atlas.mitre.org/tactics/AML\\.TA[0-9]+/)$",
375377
"type": "string"
376378
}
377379
},
@@ -392,7 +394,7 @@
392394
"type": "string"
393395
},
394396
"reference": {
395-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
397+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+/)$",
396398
"type": "string"
397399
},
398400
"subtechnique": {
@@ -406,7 +408,7 @@
406408
"type": "string"
407409
},
408410
"reference": {
409-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
411+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+\\.[0-9]+/)$",
410412
"type": "string"
411413
}
412414
},

‎detection_rules/etc/api_schemas/master/master.new_terms.json‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -294,7 +294,7 @@
294294
},
295295
"risk_score": {
296296
"maximum": 100,
297-
"minimum": 1,
297+
"minimum": 0,
298298
"type": "integer"
299299
},
300300
"risk_score_mapping": {
@@ -402,8 +402,10 @@
402402
"properties": {
403403
"framework": {
404404
"enum": [
405-
"MITRE ATT&CK"
405+
"MITRE ATT&CK",
406+
"MITRE ATLAS"
406407
],
408+
"enumNames": [],
407409
"type": "string"
408410
},
409411
"tactic": {
@@ -416,7 +418,7 @@
416418
"type": "string"
417419
},
418420
"reference": {
419-
"pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
421+
"pattern": "^(https://attack.mitre.org/tactics/TA[0-9]+/|https://atlas.mitre.org/tactics/AML\\.TA[0-9]+/)$",
420422
"type": "string"
421423
}
422424
},
@@ -437,7 +439,7 @@
437439
"type": "string"
438440
},
439441
"reference": {
440-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
442+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+/)$",
441443
"type": "string"
442444
},
443445
"subtechnique": {
@@ -451,7 +453,7 @@
451453
"type": "string"
452454
},
453455
"reference": {
454-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
456+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+\\.[0-9]+/)$",
455457
"type": "string"
456458
}
457459
},

‎detection_rules/etc/api_schemas/master/master.query.json‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@
259259
},
260260
"risk_score": {
261261
"maximum": 100,
262-
"minimum": 1,
262+
"minimum": 0,
263263
"type": "integer"
264264
},
265265
"risk_score_mapping": {
@@ -367,8 +367,10 @@
367367
"properties": {
368368
"framework": {
369369
"enum": [
370-
"MITRE ATT&CK"
370+
"MITRE ATT&CK",
371+
"MITRE ATLAS"
371372
],
373+
"enumNames": [],
372374
"type": "string"
373375
},
374376
"tactic": {
@@ -381,7 +383,7 @@
381383
"type": "string"
382384
},
383385
"reference": {
384-
"pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
386+
"pattern": "^(https://attack.mitre.org/tactics/TA[0-9]+/|https://atlas.mitre.org/tactics/AML\\.TA[0-9]+/)$",
385387
"type": "string"
386388
}
387389
},
@@ -402,7 +404,7 @@
402404
"type": "string"
403405
},
404406
"reference": {
405-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
407+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+/)$",
406408
"type": "string"
407409
},
408410
"subtechnique": {
@@ -416,7 +418,7 @@
416418
"type": "string"
417419
},
418420
"reference": {
419-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
421+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+\\.[0-9]+/)$",
420422
"type": "string"
421423
}
422424
},

‎detection_rules/etc/api_schemas/master/master.threat_match.json‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@
259259
},
260260
"risk_score": {
261261
"maximum": 100,
262-
"minimum": 1,
262+
"minimum": 0,
263263
"type": "integer"
264264
},
265265
"risk_score_mapping": {
@@ -367,8 +367,10 @@
367367
"properties": {
368368
"framework": {
369369
"enum": [
370-
"MITRE ATT&CK"
370+
"MITRE ATT&CK",
371+
"MITRE ATLAS"
371372
],
373+
"enumNames": [],
372374
"type": "string"
373375
},
374376
"tactic": {
@@ -381,7 +383,7 @@
381383
"type": "string"
382384
},
383385
"reference": {
384-
"pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
386+
"pattern": "^(https://attack.mitre.org/tactics/TA[0-9]+/|https://atlas.mitre.org/tactics/AML\\.TA[0-9]+/)$",
385387
"type": "string"
386388
}
387389
},
@@ -402,7 +404,7 @@
402404
"type": "string"
403405
},
404406
"reference": {
405-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
407+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+/)$",
406408
"type": "string"
407409
},
408410
"subtechnique": {
@@ -416,7 +418,7 @@
416418
"type": "string"
417419
},
418420
"reference": {
419-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
421+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+\\.[0-9]+/)$",
420422
"type": "string"
421423
}
422424
},

‎detection_rules/etc/api_schemas/master/master.threshold.json‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -245,7 +245,7 @@
245245
},
246246
"risk_score": {
247247
"maximum": 100,
248-
"minimum": 1,
248+
"minimum": 0,
249249
"type": "integer"
250250
},
251251
"risk_score_mapping": {
@@ -353,8 +353,10 @@
353353
"properties": {
354354
"framework": {
355355
"enum": [
356-
"MITRE ATT&CK"
356+
"MITRE ATT&CK",
357+
"MITRE ATLAS"
357358
],
359+
"enumNames": [],
358360
"type": "string"
359361
},
360362
"tactic": {
@@ -367,7 +369,7 @@
367369
"type": "string"
368370
},
369371
"reference": {
370-
"pattern": "^https://attack.mitre.org/tactics/TA[0-9]+/$",
372+
"pattern": "^(https://attack.mitre.org/tactics/TA[0-9]+/|https://atlas.mitre.org/tactics/AML\\.TA[0-9]+/)$",
371373
"type": "string"
372374
}
373375
},
@@ -388,7 +390,7 @@
388390
"type": "string"
389391
},
390392
"reference": {
391-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/$",
393+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+/)$",
392394
"type": "string"
393395
},
394396
"subtechnique": {
@@ -402,7 +404,7 @@
402404
"type": "string"
403405
},
404406
"reference": {
405-
"pattern": "^https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/$",
407+
"pattern": "^(https://attack.mitre.org/techniques/T[0-9]+/[0-9]+/|https://atlas.mitre.org/techniques/AML\\.T[0-9]+\\.[0-9]+/)$",
406408
"type": "string"
407409
}
408410
},

‎detection_rules/etc/attack-technique-redirects.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -133,5 +133,5 @@
133133
"T1547.011": "T1647",
134134
"T1574.002": "T1574.001"
135135
},
136-
"saved_date": "Tue Nov 11 12:54:18 2025"
136+
"saved_date": "Mon Dec 8 17:34:00 2025"
137137
}

‎detection_rules/etc/attack-v18.0.0.json.gz‎

-7.15 MB
Binary file not shown.

0 commit comments

Comments
 (0)