[Security][Detections] Support threat subtechniques

[rw-access]

Related/blocked by #69166
Related to elastic/ecs#867

i’m looking at ATT&CK subtechniques.
I think the best approach for ECS and SIEM is to nest subtechnique under threat.technique. then it’d be threat.technique.subtechnique

currently our schema for looks like this

"threat": [
  {
    "tactic": {
      "id": "TAXXX",
      "name": "Some Tactic",
      "reference": "https://attack.mitre.org/TAXXX"
    },
    "technique": [
      {
        "id": "TXXX",
        "name": "Some Technique",
        "reference": "https://attack.mitre.org/TXXX"
      },
  },
]

and #69166 will allow many-many for tactic-techniques:

"threat": [
  {
    "tactic": [
      {
        "id": "TAXXX",
        "name": "Some Tactic",
        "reference": "https://attack.mitre.org/TAXXX"
      },
    ],
    "technique": [
      {
        "id": "TXXX",
        "name": "Some Technique",
        "reference": "https://attack.mitre.org/TXXX"
      },
  },
]

We still need to add subtechniques, which should be optional. Unlike tactics and techniques, there is a strict one -> many relationship for techniques -> subtechniques. I think the most natural solution is this:

"threat": [
  {
    "tactic": [
      {
  {
    "tactic": [
      {
        "id": "TAXXX",
        "name": "Some Tactic",
        "reference": "https://attack.mitre.org/TAXXX"
      },
    ],
    "technique": [
      {
        "id": "TXXX",
        "name": "Some Technique",
        "reference": "https://attack.mitre.org/TXXX"
        "subtechnique": [
          {
            "id": "TXXX.YYY",
            "name": "Some subtechnique,
            "reference": "https://attack.mitre.org/TXXX/YYY"
          },
        ]
      },
  },
]

This translates very nicely to the UI, and we can add a bulleted list of subtechnique under the techniques

• Tactic [, Tactic]
  • Technique
    • Subtechnique
  • Technique
• Tactic

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[dontcallmesherryli]

Created ticket for app update to support subtechniques: https://github.com/elastic/security-team/issues/279

[rw-access]

@dplumlee @peluja1012 I think we can close this issue now. Is that right?

[peluja1012]

@rw-access We're good to close. Thanks. This PR implements it #83511.