Skip to content

Commit 66922bc

Browse files
dplumleemaximpnelasticmachine
committed
[Security Solution] Updates kibana MITRE data to v16.1 (elastic#215026)
## Summary Addresses: elastic#166152 for `8.18.1` and elastic#203370 Updates MITRE ATT&CK mappings to `v16.1`. Last update was to `v15.1` in elastic#183463. To update, I modified https://github.com/elastic/kibana/blob/df55627b2d695b8721928cb453db31e2b5cb73a4/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22 to point to the `ATT&CK-v16.1` tag. Then ran `yarn extract-mitre-attacks` from the root `security_solution` plugin directory, and then `node scripts/i18n_check.js --fix` from Kibana root to regen the i18n files. ## Acceptance Criteria - [x] User can map and use new MITRE techniques in Security Solution - [ ] The user-facing documentation is updated with the new version - [ ] [MITRE ATT&CK® coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html) page - [ ] elastic/security-docs#6797 - [ ] elastic/docs-content#1292 ## Test Criteria This PR also updates our cypress tests which run with real MITRE data generated by the same `extract_tactics_techniques_mitre` script. Our tests would often break when the data was updated to a new version because the UI elements being tested would cover each other leading to flakiness or outright test failure. In order to ensure a more streamline update process the tests should no longer break because of this flakiness and only when there's a more serious issue. - [x] Verify that new techniques (see the changelog link above) are available for mapping on the Rule Creation page under "Advanced settings" - [x] Verify that new techniques are available on the MITRE ATT&CK coverage page --------- Co-authored-by: Maxim Palenov <[email protected]> Co-authored-by: Elastic Machine <[email protected]> (cherry picked from commit 203cfc6)
1 parent 3072c52 commit 66922bc

File tree

7 files changed

+313
-69
lines changed

7 files changed

+313
-69
lines changed

x-pack/platform/plugins/private/translations/translations/fr-FR.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39443,7 +39443,6 @@
3944339443
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.processHollowingT1055Description": "Remplacement de processus (T1055.012)",
3944439444
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.procFilesystemT1003Description": "Système de fichiers proc (T1003.007)",
3944539445
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.procMemoryT1055Description": "Mémoire proc (T1055.009)",
39446-
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.protocolImpersonationT1001Description": "Usurpation d'identité de protocole (T1001.003)",
3944739446
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.ptraceSystemCallsT1055Description": "Appels système Ptrace (T1055.008)",
3944839447
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.pubPrnT1216Description": "PubPrn (T1216.001)",
3944939448
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.purchaseTechnicalDataT1597Description": "Données techniques d'achat (T1597.002)",

x-pack/platform/plugins/private/translations/translations/ja-JP.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39412,7 +39412,6 @@
3941239412
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.processHollowingT1055Description": "プロセスハロウイング(T1055.012)",
3941339413
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.procFilesystemT1003Description": "プロセスファイルシステム(T1003.007)",
3941439414
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.procMemoryT1055Description": "プロセスメモリ(T1055.009)",
39415-
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.protocolImpersonationT1001Description": "プロトコルなりすまし(T1001.003)",
3941639415
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.ptraceSystemCallsT1055Description": "Ptrace システムコール(T1055.008)",
3941739416
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.pubPrnT1216Description": "PubPrn (T1216.001)",
3941839417
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.purchaseTechnicalDataT1597Description": "技術データの購入(T1597.002)",

x-pack/platform/plugins/private/translations/translations/zh-CN.json

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39482,7 +39482,6 @@
3948239482
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.processHollowingT1055Description": "Process Hollowing (T1055.012)",
3948339483
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.procFilesystemT1003Description": "Proc Filesystem (T1003.007)",
3948439484
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.procMemoryT1055Description": "Proc Memory (T1055.009)",
39485-
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.protocolImpersonationT1001Description": "Protocol Impersonation (T1001.003)",
3948639485
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.ptraceSystemCallsT1055Description": "Ptrace System Calls (T1055.008)",
3948739486
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.pubPrnT1216Description": "PubPrn (T1216.001)",
3948839487
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.purchaseTechnicalDataT1597Description": "Purchase Technical Data (T1597.002)",

0 commit comments

Comments
 (0)