Skip to content

Commit a4a93f9

Browse files
dplumleekibanamachine
authored andcommitted
[Security Solution] Updates kibana MITRE data to v17.1 (elastic#231375)
## Summary Addresses: elastic#166152 for `9.2.0` Updates MITRE ATT&CK mappings to `v17.1`. Last update was to `v16.1` in elastic#215026. To update, I modified https://github.com/elastic/kibana/blob/1d54622d8318295d9d0509b34c1b36c811a2382e/x-pack/solutions/security/plugins/security_solution/scripts/extract_tactics_techniques_mitre.js#L22 to point to the `ATT&CK-v17.1` tag. Then ran `yarn extract-mitre-attacks` from the root `security_solution` plugin directory, and then `node scripts/i18n_check.js --fix` from Kibana root to regen the i18n files. ### Note This PR also adds guards to the test generation script so that it prevents duplicate data being generated and causing tests breaking after running this script. Another step in hopefully making this data generation and related testing entirely automated. ## Acceptance Criteria - [x] User can map and use new MITRE techniques in Security Solution - [ ] The user-facing documentation is updated with the new version - [ ] [MITRE ATT&CK® coverage](https://www.elastic.co/guide/en/security/master/rules-coverage.html) page - [ ] elastic/docs-content#2518 ## Test Criteria - [x] Verify that new techniques (see the changelog link above) are available for mapping on the Rule Creation page under "Advanced settings" - [x] Verify that new techniques are available on the MITRE ATT&CK coverage page --------- Co-authored-by: kibanamachine <[email protected]>
1 parent f01f19d commit a4a93f9

File tree

6 files changed

+348
-93
lines changed

6 files changed

+348
-93
lines changed

x-pack/platform/plugins/private/translations/translations/de-DE.json

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35290,8 +35290,6 @@
3529035290
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.diskContentWipeT1561Description": "Festplatteninhalt löschen (T1561.001)",
3529135291
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.diskStructureWipeT1561Description": "Festplattenstruktur löschen (T1561.002)",
3529235292
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.distributedComponentObjectModelT1021Description": "Objektmodell für verteilte Komponenten (T1021.003)",
35293-
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.dllSearchOrderHijackingT1574Description": "Hijacking der DLL-Suchreihenfolge (T1574.001)",
35294-
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.dllSideLoadingT1574Description": "DLL-Side-Loading (T1574.002)",
3529535293
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.dnsCalculationT1568Description": "DNS-Berechnung (T1568.003)",
3529635294
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.dnsPassiveDnsT1596Description": "DNS/Passive DNS (T1596.001)",
3529735295
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.dnsServerT1583Description": "DNS-Server (T1583.002)",
@@ -35424,7 +35422,6 @@
3542435422
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.masqueradeAccountNameT1036Description": "Masquerade-Kontoname (T1036.010)",
3542535423
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.masqueradeFileTypeT1036Description": "Maskerade-Dateityp (T1036.008)",
3542635424
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.masqueradeTaskOrServiceT1036Description": "Masquerade-Aufgabe oder -Dienst (T1036.004)",
35427-
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.matchLegitimateNameOrLocationT1036Description": "Übereinstimmung mit einem legitimen Namen oder Standort (T1036.005)",
3542835425
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.mavinjectT1218Description": "Mavinject (T1218.013)",
3542935426
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.messagingApplicationsT1213Description": "Messaging-Anwendungen (T1213.005)",
3543035427
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.mmcT1218Description": "MMC (T1218.014)",
@@ -35501,7 +35498,6 @@
3550135498
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.remoteDataStagingT1074Description": "Remote-Daten-Staging (T1074.002)",
3550235499
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.remoteDesktopProtocolT1021Description": "Remote Desktop Protocol (T1021.001)",
3550335500
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.remoteEmailCollectionT1114Description": "Remote-E-Mail-Sammlung (T1114.002)",
35504-
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.renameSystemUtilitiesT1036Description": "Systemdienstprogramme umbenennen (T1036.003)",
3550535501
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.reOpenedApplicationsT1547Description": "Wiedereröffnete Anwendungen (T1547.007)",
3550635502
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.resourceForkingT1564Description": "Ressourcen-Forking (T1564.009)",
3550735503
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.reversibleEncryptionT1556Description": "Reversible Verschlüsselung (T1556.005)",
@@ -35657,7 +35653,6 @@
3565735653
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.bitsJobsDescription": "BITS Jobs (T1197)",
3565835654
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.bootOrLogonAutostartExecutionDescription": "Autostart-Ausführung bei Systemstart oder Anmeldung (T1547)",
3565935655
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.bootOrLogonInitializationScriptsDescription": "Boot- oder Anmeldeinitialisierungsskripte (T1037)",
35660-
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.browserExtensionsDescription": "Browser-Erweiterungen (T1176)",
3566135656
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.browserInformationDiscoveryDescription": "Browser-Informationserkennung (T1217)",
3566235657
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.browserSessionHijackingDescription": "Browser-Session-Hijacking (T1185)",
3566335658
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.bruteForceDescription": "Brute Force (T1110)",
@@ -35786,7 +35781,6 @@
3578635781
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.proxyDescription": "Proxy (T1090)",
3578735782
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.queryRegistryDescription": "Registry-Abfrage (T1012)",
3578835783
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.reflectiveCodeLoadingDescription": "Reflektierendes Code-Laden (T1620)",
35789-
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.remoteAccessSoftwareDescription": "Remote Access Software (T1219)",
3579035784
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.remoteServicesDescription": "Remote-Dienste (T1021)",
3579135785
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.remoteServiceSessionHijackingDescription": "Hijacking von Remote-Service-Sitzungen (T1563)",
3579235786
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.remoteSystemDiscoveryDescription": "Systemerkennung per Fernzugriff (T1018)",

x-pack/platform/plugins/private/translations/translations/fr-FR.json

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35368,8 +35368,6 @@
3536835368
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.diskContentWipeT1561Description": "Effacement du contenu du disque (T1561.001)",
3536935369
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.diskStructureWipeT1561Description": "Effacement de la structure du disque (T1561.002)",
3537035370
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.distributedComponentObjectModelT1021Description": "Modèle d'objet du composant distribué (T1021.003)",
35371-
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.dllSearchOrderHijackingT1574Description": "Piratage de l'ordre de recherche des DLL (T1574.001)",
35372-
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.dllSideLoadingT1574Description": "Chargement latéral des DLL (T1574.002)",
3537335371
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.dnsCalculationT1568Description": "Calcul DNS (T1568.003)",
3537435372
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.dnsPassiveDnsT1596Description": "DNS/DNS passif (T1596.001)",
3537535373
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.dnsServerT1583Description": "Serveur DNS (T1583.002)",
@@ -35502,7 +35500,6 @@
3550235500
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.masqueradeAccountNameT1036Description": "Nom du compte Masquerade (T1036.010)",
3550335501
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.masqueradeFileTypeT1036Description": "Type de fichier de mascarade (T1036.008)",
3550435502
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.masqueradeTaskOrServiceT1036Description": "Tâche ou service de mascarade (T1036.004)",
35505-
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.matchLegitimateNameOrLocationT1036Description": "Correspondance de nom ou d'emplacement légitime (T1036.005)",
3550635503
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.mavinjectT1218Description": "Mavinject (T1218.013)",
3550735504
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.messagingApplicationsT1213Description": "Applications de messagerie (T1213.005)",
3550835505
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.mmcT1218Description": "MMC (T1218.014)",
@@ -35579,7 +35576,6 @@
3557935576
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.remoteDataStagingT1074Description": "Mise en service de données distantes (T1074.002)",
3558035577
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.remoteDesktopProtocolT1021Description": "Protocole de bureau distant (T1021.001)",
3558135578
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.remoteEmailCollectionT1114Description": "Collection d'e-mails distants (T1114.002)",
35582-
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.renameSystemUtilitiesT1036Description": "Renommage d'utilitaires système (T1036.003)",
3558335579
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.reOpenedApplicationsT1547Description": "Réouverture d'applications (T1547.007)",
3558435580
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.resourceForkingT1564Description": "Fourchettes de ressources (T1564.009)",
3558535581
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.reversibleEncryptionT1556Description": "Chiffrement réversible (T1556.005)",
@@ -35735,7 +35731,6 @@
3573535731
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.bitsJobsDescription": "Tâches BITS (T1197)",
3573635732
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.bootOrLogonAutostartExecutionDescription": "Exécution de démarrage ou de démarrage automatique de connexion (T1547)",
3573735733
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.bootOrLogonInitializationScriptsDescription": "Scripts de démarrage ou d'initialisation de connexion (T1037)",
35738-
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.browserExtensionsDescription": "Extensions de navigateur (T1176)",
3573935734
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.browserInformationDiscoveryDescription": "Découverte d'informations de navigateur (T1217)",
3574035735
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.browserSessionHijackingDescription": "Détournement de session de navigateur (T1185)",
3574135736
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.bruteForceDescription": "Force brute (T1110)",
@@ -35864,7 +35859,6 @@
3586435859
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.proxyDescription": "Proxy (T1090)",
3586535860
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.queryRegistryDescription": "Interrogation du registre (T1012)",
3586635861
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.reflectiveCodeLoadingDescription": "Chargement de code réflexif (T1620)",
35867-
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.remoteAccessSoftwareDescription": "Logiciel d'accès à distance(T1219)",
3586835862
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.remoteServicesDescription": "Services distants (T1021)",
3586935863
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.remoteServiceSessionHijackingDescription": "Piratage de session de service distant (T1563)",
3587035864
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.remoteSystemDiscoveryDescription": "Découverte de système distant (T1018)",

x-pack/platform/plugins/private/translations/translations/ja-JP.json

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35407,8 +35407,6 @@
3540735407
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.diskContentWipeT1561Description": "ディスク内容のワイプ(T1561.001)",
3540835408
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.diskStructureWipeT1561Description": "ディスク構造のワイプ(T1561.002)",
3540935409
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.distributedComponentObjectModelT1021Description": "分散コンポーネントオブジェクトモデル(T1021.003)",
35410-
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.dllSearchOrderHijackingT1574Description": "DLL 検索順序ハイジャック(T1574.001)",
35411-
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.dllSideLoadingT1574Description": "DLL サイドロード(T1574.002)",
3541235410
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.dnsCalculationT1568Description": "DNS 計算(T1568.003)",
3541335411
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.dnsPassiveDnsT1596Description": "DNS/パッシブ DNS(T1596.001)",
3541435412
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.dnsServerT1583Description": "DNS サーバー(T1583.002)",
@@ -35541,7 +35539,6 @@
3554135539
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.masqueradeAccountNameT1036Description": "マスカレードアカウント名(T1036.010)",
3554235540
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.masqueradeFileTypeT1036Description": "マスカレードファイルタイプ(T1036.008)",
3554335541
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.masqueradeTaskOrServiceT1036Description": "マスカレードタスクまたはサービス(T1036.004)",
35544-
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.matchLegitimateNameOrLocationT1036Description": "合法的な名前または場所と一致(T1036.005)",
3554535542
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.mavinjectT1218Description": "Mavinject (T1218.013)",
3554635543
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.messagingApplicationsT1213Description": "メッセージングアプリケーション (T1213.005)",
3554735544
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.mmcT1218Description": "MMC (T1218.014)",
@@ -35618,7 +35615,6 @@
3561835615
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.remoteDataStagingT1074Description": "データステージングの削除(T1074.002)",
3561935616
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.remoteDesktopProtocolT1021Description": "リモートデスクトッププロトコル(T1021.001)",
3562035617
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.remoteEmailCollectionT1114Description": "リモート電子メール収集(T1114.002)",
35621-
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.renameSystemUtilitiesT1036Description": "システムユーティリティ名の変更(T1036.003)",
3562235618
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.reOpenedApplicationsT1547Description": "再オープンされたアプリケーション(T1547.007)",
3562335619
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.resourceForkingT1564Description": "リソースフォーク(T1564.009)",
3562435620
"xpack.securitySolution.detectionEngine.mitreAttackSubtechniques.reversibleEncryptionT1556Description": "解読可能な暗号化(T1556.005)",
@@ -35774,7 +35770,6 @@
3577435770
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.bitsJobsDescription": "BITSジョブ(T1197)",
3577535771
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.bootOrLogonAutostartExecutionDescription": "ブートまたはログオン自動起動実行(T1547)",
3577635772
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.bootOrLogonInitializationScriptsDescription": "ブートまたはログオン初期化スクリプト(T1037)",
35777-
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.browserExtensionsDescription": "ブラウザー拡張(T1176)",
3577835773
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.browserInformationDiscoveryDescription": "ブラウザー情報検出(T1217)",
3577935774
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.browserSessionHijackingDescription": "ブラウザーセッションハイジャック(T1185)",
3578035775
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.bruteForceDescription": "Brute Force(T1110)",
@@ -35903,7 +35898,6 @@
3590335898
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.proxyDescription": "プロキシ(T1090)",
3590435899
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.queryRegistryDescription": "クエリレジストリ(T1012)",
3590535900
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.reflectiveCodeLoadingDescription": "Reflective Code Loading(T1620)",
35906-
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.remoteAccessSoftwareDescription": "リモートアクセスソフトウェア(T1219)",
3590735901
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.remoteServicesDescription": "リモートサービス(T1021)",
3590835902
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.remoteServiceSessionHijackingDescription": "リモートサービスセッションハイジャック(T1563)",
3590935903
"xpack.securitySolution.detectionEngine.mitreAttackTechniques.remoteSystemDiscoveryDescription": "リモートシステム検出(T1018)",

0 commit comments

Comments
 (0)