[Security][Detections] Support many -> many threat techniques

[rw-access]

Right now, techniques and techniques are related as a parent-child. For each tactic, list all of the techniques.

This doesn't exactly map to how MITRE ATT&CK approaches it, since a single technique can be used in multiple tactics. If we line up a little better, we can make the mappings more clear and more concise.

I&A would love to map this way. Also, there are use cases for linking to an ATT&CK tactic, without having any particular techniques. We don't have any practical cases for referencing a technique without a tactic, so it's not a full decoupling.

Ideally, we would be able to build a mapping like this (verbose example to cover many use cases)

• Privilege Escalation, Persistence
  • New Service
  • Scheduled Task
• Execution
  • Service Execution
• Lateral Movement

This would correspond to a threat like this:

"threat": [
  {
    "framework": "MITRE ATT&CK",
    "tactics": [
      {
        "id": "TAXXX",
        "name": "Privilege Escalation",
        "reference": "https://attack.mitre.org/..."
      },
      {
        "id": "TAXXX",
        "name": "Persistence",
        "reference": "https://attack.mitre.org/..."
      },
    ],
    "techniques": [
      {
        "id": "TXXX",
        "name": "New Service",
        "reference": "https://attack.mitre.org/..."
      },
      {
        "id": "TXXX",
        "name": "Scheduled Task",
        "reference": "https://attack.mitre.org/..."
      },
    ]
  },
  {
    "framework": "MITRE ATT&CK",
    "tactics": [
      {
        "id": "TAXXX",
        "name": "Execution",
        "reference": "https://attack.mitre.org/..."
      },
    ],
    "techniques": [
      {
        "id": "TXXX",
        "name": "Service Execution",
        "reference": "https://attack.mitre.org/..."
      },
    ]
  },
  {
    "framework": "MITRE ATT&CK",
    "tactics": [
      {
        "id": "TAXXX",
        "name": "Lateral Movement",
        "reference": "https://attack.mitre.org/..."
      },
    ],
    "techniques": []
  },
]

cc @elastic/security-intelligence-analytics

[elasticmachine]

Pinging @elastic/kibana-security (Team:Security)

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[rw-access]

I'm going to close this issue. Since tactics are now optional, I think this gives good enough flexibility, so we can focus efforts elsewhere. We can always reopen later if this is pressing