[SIEM] [DETECTION ENG] Add MITRE ATT&CK

[XavierM]

Summary

Create a script to get all the value of Tactics and Techniques from the Mitre JSON file + create the internationalization with it

To run the script go under the SIEM plugin folder and run yarn extract-mitre-attacks

Add a component to add tactics and techniques from MITRE ATT&CK Enterprise on the rule.

Checklist

Use strikethroughs to remove checklist items you don't feel are applicable to this PR.

• [ ] This was checked for cross-browser compatibility, including a check against IE11
• [ ] Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• [ ] Documentation was added for features that require explanation or tutorials
• [ ] Unit or functional tests were updated or added to match the most common scenarios
• [ ] This was checked for keyboard-only and screenreader accessibility

For maintainers

• [ ] This was checked for breaking API changes and was labeled appropriately
• [ ] This includes a feature addition or change that requires a release note and was labeled appropriately

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[spong]

Grabbed the latest and looped through again -- noticing the following things:

• ✅ Still seeing backend.js:6 Warning: Each child in a list should have a unique "key" prop in the console after submitting all fields for step 1 (left comment in code)
• ✅Selecting a tactic and then re-selecting Select Tactic ... is an invalid state and you have to delete the whole MITRE line to pass validation
• ✅ An Empty MITRE Attack shows up in About Rule rollup if not selected (if deleted with trashcan, doesn't show up at all, which feels like the expected behavior)
• ✅ Inputing a Reference/FP, then adding another but leaving blank will result in empty tags on the rollup, and then going back to edit will not have the original values till the second empty one is deleted
• ✅ Inputing a Reference/FP, then clicking to add another twice will remove the value in the first field

Let me know if you have any questions around the specifics -- I'll update this comment when I test again.

[spong]

This is absolutely awesome @XavierM! Thanks for taking the time to make a re-usable script for updating these -- our future selves are thanking you graciously! 😅 I tested this with both removing some fields from the current and deleting the file altogether and looks good! When deleting the file for a clean re-gen it'll give a no matching pattern error when trying to lint (and you'll have to lint manually), but it still generates fine. (Not a big deal since we'll be generating with the file in tact.)

[spong]

Checked out locally, tested thoroughly, and performed code review. LGTM! 👍

As commented, thanks for not only taking the time to write a script to automate the generation of these rules, but for also looping back around to improve/fix the lingering usability quarks. Really appreciate it @XavierM! 🙂

[elasticmachine]

💚 Build Succeeded

• continuous-integration/kibana-ci/pull-request
• Commit: 86952c9

History

• 💔 Build #14430 failed 83a14de
• 💚 Build #14389 succeeded 7bdd58a
• 💚 Build #14235 succeeded e398e52
• 💔 Build #14058 failed 823a1b9

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream