Skip to content

Add tactics_techniques field on event definitions - #25977

Merged
danotorrey merged 21 commits into
masterfrom
feature/event-definition-mitre-tactics-techniques
Jun 4, 2026
Merged

Add tactics_techniques field on event definitions#25977
danotorrey merged 21 commits into
masterfrom
feature/event-definition-mitre-tactics-techniques

Conversation

@danotorrey

@danotorrey danotorrey commented May 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

Adds a tactics_techniques keyword array on event definitions and propagates it to produced events. Format validation (regex on shape) runs unconditionally; semantic validation and UI are pluggable.

What's in here

  • tactics_techniques array on EventDefinition / EventDefinitionDto / EventDefinitionEntity. Format validated by regex; values normalized (uppercased) on save via TacticsTechniquesNormalizer, mirroring TagNormalizer.
  • Field stamped onto produced events by EventProcessorEventFactory and mapped as a keyword on the events index.
  • TacticsTechniquesValidator extension point with a no-op default binding.
  • Plugin slot contracts in event-definitions/types.ts:
    • eventDefinitions.components.tacticsTechniquesEditor — edit-form section
    • eventDefinitions.components.tacticsTechniquesColumn — list column
  • MitreBackwardsCompatibilityFilter — search helper used by the three OSS storage adapters so legacy and new field shapes can be queried together.
  • TagsCell generalized to ChipsCell; tags column behavior unchanged.

/nocl

Test plan

  • POST event def with format-valid values → stored uppercase, round-trips via GET.
  • Reject malformed values and arrays larger than the cap.
  • ?query=tactics_techniques:<value> matches the def.
  • Trigger the def; produced event _source carries the field.

danotorrey added 4 commits May 11, 2026 15:38
@danotorrey
Add MITRE categories field to event definitions
3493294 
Adds a single `mitre_categories` keyword array on event definitions and stamps
it onto every produced event (mapped at the top level of the events index).
Validation accepts tactic, technique, and sub-technique IDs through one
combined regex; the 64-value cap is enforced. Frontend types, fixtures, and
event-def save telemetry track the new field.

Includes a `MitreBackwardsCompatibilityFilter` helper used by the three
storage-adapter `MoreSearchAdapter` implementations to OR the legacy
`event.fields.sigma_rule_tag_*` filter shape with the new `mitre_categories`
shape during the migration window. Scoped for removal alongside the legacy
path.

Co-Authored-By: Claude Opus 4.7 (1M context) <[EMAIL_ADDRESS_REDACTED]>
@danotorrey
Fix FilterPreviewContainer test fixture missing mitre_categories
9255d03 
CI yarn tsc surfaced a typed `EventDefinition` literal that hadn't been updated
when the field was added.

Co-Authored-By: Claude Opus 4.7 (1M context) <[EMAIL_ADDRESS_REDACTED]>
@danotorrey
Merge remote-tracking branch 'origin/master' into feature/event-defin…
ad94b42 
…ition-mitre-tactics-techniques

# Conflicts:
#	graylog2-server/src/main/java/org/graylog/events/contentpack/entities/EventDefinitionEntity.java
#	graylog2-server/src/main/java/org/graylog/events/event/Event.java
#	graylog2-server/src/main/java/org/graylog/events/event/EventDto.java
#	graylog2-server/src/main/java/org/graylog/events/event/EventProcessorEventFactory.java
#	graylog2-server/src/main/java/org/graylog/events/processor/EventDefinitionDto.java
#	graylog2-server/src/main/java/org/graylog/events/rest/EventDefinitionsResource.java
#	graylog2-server/src/main/java/org/graylog2/indexer/template/EventsIndexMapping.java
#	graylog2-web-interface/src/components/events/events/types.ts
@danotorrey
Rename to tactics_techniques + add validator extension point
7279b9d 
- Rename `mitre_categories` to `tactics_techniques` across DTO, JSON, ES
  mapping, content-pack entity, FE types, fixtures.
- `TacticsTechniquesNormalizer` (mirrors `TagNormalizer`): trim, upper-case,
  drop empties. Applied in `EventDefinitionDto.Builder.build()`.
- `TacticsTechniquesValidator` Guice extension point with OSS no-op default;
  wired into create/update/validate endpoints. Enterprise overrides to
  reject IDs not in the Illuminate LUTs.
- New "Tactics/Techniques" column on the Event Definitions list.
- Editor on the event-def edit form and chip on the list column are pluggable
  (`eventDefinitions.tacticsTechniquesEditor`, `eventDefinitions.tacticsTechniquesChip`).
  OSS leaves both empty.
- Rename `TagsCell` → `ChipsCell` with generic prop names. Tags and
  Tactics/Techniques share the collapse / +N overflow UX.
- `EventImpl.equals/hashCode/toString` now include the new field.
- New TacticsTechniquesNormalizerTest; expanded EventDefinitionDtoTest,
  EventProcessorEventFactoryTest, EventDefinitionsResourceTest.
@danotorrey danotorrey changed the title Add mitre_categories field to event definitions Add tactics_techniques to event definitions May 22, 2026
danotorrey added 12 commits May 21, 2026 21:21
@danotorrey
Merge remote-tracking branch 'origin/master' into feature/event-defin…
6c3f288 
…ition-mitre-tactics-techniques

# Conflicts:
#	graylog2-server/src/main/java/org/graylog/events/rest/EventDefinitionsResource.java
@danotorrey
Merge remote-tracking branch 'origin/master' into feature/event-defin…
8804671 
…ition-mitre-tactics-techniques
@danotorrey
Merge branch 'master' into feature/event-definition-mitre-tactics-tec…
ffc04b9 
…hniques
@danotorrey
Drop tactics_techniques UI surfaces
a286070 
Remove the events list column, event-defs list column, summary view
row, and expanded details row. Schema and plugin slot wiring remain.

Assisted with Claude Code
@danotorrey
Merge branch 'feature/event-definition-mitre-tactics-techniques' of g…
9351a40 
…ithub.com:Graylog2/graylog2-server into feature/event-definition-mitre-tactics-techniques
@danotorrey
Decouple tactics_techniques from UI: optional type + extension point
5f8a55a 
- Make `tactics_techniques` optional on the FE EventDefinition type so
  consumers that don't set it (older fixtures, ad-hoc instances) still
  type-check. Mutation hook fills `[]` when sending to the API.
- Drop tactics_techniques from the Event Definitions EntityAttribute
  list; keep it as an extraSearchField so API search still works.
- Fix TableElement.getColumnRenderer typing to return the
  ColumnRenderersByAttribute map instead of a single ColumnRenderer.
  Make expandedSection / tableCellComponent optional and have the
  consumer handle their absence.

Assisted with Claude Code
@danotorrey
Drop TableElement type cleanup from this PR
6b692aa 
Roll back the getColumnRenderer signature fix and the optional
expandedSection/tableCellComponent change. They're a worthwhile
cleanup but they create cross-repo coupling — anywhere a downstream
plugin had `@ts-expect-error` working around the old signature, the
directive becomes unused once the type is corrected. That tripped CI
on this PR. Will revisit in a standalone follow-up that touches both
repos together.

Assisted with Claude Code
@danotorrey
Wording; always show TC Improve Coverage button
f410039 
Assisted with Claude Code
@danotorrey
Review fixes
45d5e61 
Assisted with Claude Code
@danotorrey
Review fixes: plugin contract location, key namespace, theme, lint
73d5de0 
Assisted with Claude Code
@danotorrey
Merge remote-tracking branch 'origin/master' into feature/event-defin…
17f6d61 
…ition-mitre-tactics-techniques

# Conflicts:
#	graylog2-server/src/test/java/org/graylog/events/processor/EventDefinitionDtoTest.java
@danotorrey
Fix test: error message uses upper-cased IDs
39a6a4d 
Assisted with Claude Code
@danotorrey danotorrey changed the title Add tactics_techniques to event definitions Add tactics_techniques field on event definitions May 26, 2026
danotorrey and others added 2 commits May 26, 2026 14:02
@danotorrey @claude
Add dedicated plugin slot for tactics/techniques column
534fe5d 
Replaces use of the shared entityTableElements slot to keep the column
scoped to event definitions. The plugin owns the attribute (id/title/sortable),
the cell component, and the license gate.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@danotorrey @claude
Fix padding-line-between-statements lint
6261df5 
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@danotorrey danotorrey added the e2e-tests Run PR build with e2e tests. label May 26, 2026
@danotorrey
danotorrey marked this pull request as ready for review May 27, 2026 02:46
@danotorrey

danotorrey commented May 27, 2026

Copy link
Copy Markdown
Contributor Author

The e2e failures seem to match those on the enterprise side, which all appear to be preexisting (not from these PRs). See https://github.com/Graylog2/graylog-plugin-enterprise/pull/14205#issuecomment-4554987322.

danotorrey and others added 2 commits May 27, 2026 10:29
@danotorrey @claude
Add plugin slots for tactics/techniques detail row and summary
dc35c83 
Two new slots on the event-definition / events UI:
- events.components.tacticsTechniquesDetailRow - consumed by the events
  details expanded section to render a row next to Tags.
- eventDefinitions.components.tacticsTechniquesSummary - consumed by the
  event definition summary view to render a row next to Tags.

Server defines the slot contracts; the security plugin contributes the
components, gates them on the security license, and owns the dual-read
between the new tactics_techniques field and the legacy sigma_rule_tag_*
shape.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@danotorrey
Merge branch 'master' into feature/event-definition-mitre-tactics-tec…
8713282 
…hniques
kingzacko1
kingzacko1 approved these changes Jun 1, 2026
View reviewed changes

@kingzacko1 kingzacko1 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

backend LGTM

@danotorrey
Merge remote-tracking branch 'origin/master' into feature/event-defin…
889caac 
…ition-mitre-tactics-techniques

# Conflicts:
#	graylog2-web-interface/src/components/event-definitions/event-definition-form/EventDefinitionFormContainer.tsx
#	graylog2-web-interface/src/components/event-definitions/types.ts
@danotorrey
danotorrey merged commit b736a55 into master Jun 4, 2026
24 of 25 checks passed
@danotorrey
danotorrey deleted the feature/event-definition-mitre-tactics-techniques branch June 4, 2026 03:11
dennisoelkers pushed a commit that referenced this pull request Jun 4, 2026
@danotorrey @claude @dennisoelkers
Add tactics_techniques field on event definitions (#25977)
603146f 
* Add MITRE categories field to event definitions

Adds a single `mitre_categories` keyword array on event definitions and stamps
it onto every produced event (mapped at the top level of the events index).
Validation accepts tactic, technique, and sub-technique IDs through one
combined regex; the 64-value cap is enforced. Frontend types, fixtures, and
event-def save telemetry track the new field.

Includes a `MitreBackwardsCompatibilityFilter` helper used by the three
storage-adapter `MoreSearchAdapter` implementations to OR the legacy
`event.fields.sigma_rule_tag_*` filter shape with the new `mitre_categories`
shape during the migration window. Scoped for removal alongside the legacy
path.

Co-Authored-By: Claude Opus 4.7 (1M context) <[EMAIL_ADDRESS_REDACTED]>

* Fix FilterPreviewContainer test fixture missing mitre_categories

CI yarn tsc surfaced a typed `EventDefinition` literal that hadn't been updated
when the field was added.

Co-Authored-By: Claude Opus 4.7 (1M context) <[EMAIL_ADDRESS_REDACTED]>

* Rename to tactics_techniques + add validator extension point

- Rename `mitre_categories` to `tactics_techniques` across DTO, JSON, ES
  mapping, content-pack entity, FE types, fixtures.
- `TacticsTechniquesNormalizer` (mirrors `TagNormalizer`): trim, upper-case,
  drop empties. Applied in `EventDefinitionDto.Builder.build()`.
- `TacticsTechniquesValidator` Guice extension point with OSS no-op default;
  wired into create/update/validate endpoints. Enterprise overrides to
  reject IDs not in the Illuminate LUTs.
- New "Tactics/Techniques" column on the Event Definitions list.
- Editor on the event-def edit form and chip on the list column are pluggable
  (`eventDefinitions.tacticsTechniquesEditor`, `eventDefinitions.tacticsTechniquesChip`).
  OSS leaves both empty.
- Rename `TagsCell` → `ChipsCell` with generic prop names. Tags and
  Tactics/Techniques share the collapse / +N overflow UX.
- `EventImpl.equals/hashCode/toString` now include the new field.
- New TacticsTechniquesNormalizerTest; expanded EventDefinitionDtoTest,
  EventProcessorEventFactoryTest, EventDefinitionsResourceTest.

* Drop tactics_techniques UI surfaces

Remove the events list column, event-defs list column, summary view
row, and expanded details row. Schema and plugin slot wiring remain.

Assisted with Claude Code

* Decouple tactics_techniques from UI: optional type + extension point

- Make `tactics_techniques` optional on the FE EventDefinition type so
  consumers that don't set it (older fixtures, ad-hoc instances) still
  type-check. Mutation hook fills `[]` when sending to the API.
- Drop tactics_techniques from the Event Definitions EntityAttribute
  list; keep it as an extraSearchField so API search still works.
- Fix TableElement.getColumnRenderer typing to return the
  ColumnRenderersByAttribute map instead of a single ColumnRenderer.
  Make expandedSection / tableCellComponent optional and have the
  consumer handle their absence.

Assisted with Claude Code

* Drop TableElement type cleanup from this PR

Roll back the getColumnRenderer signature fix and the optional
expandedSection/tableCellComponent change. They're a worthwhile
cleanup but they create cross-repo coupling — anywhere a downstream
plugin had `@ts-expect-error` working around the old signature, the
directive becomes unused once the type is corrected. That tripped CI
on this PR. Will revisit in a standalone follow-up that touches both
repos together.

Assisted with Claude Code

* Wording; always show TC Improve Coverage button

Assisted with Claude Code

* Review fixes

Assisted with Claude Code

* Review fixes: plugin contract location, key namespace, theme, lint

Assisted with Claude Code

* Fix test: error message uses upper-cased IDs

Assisted with Claude Code

* Add dedicated plugin slot for tactics/techniques column

Replaces use of the shared entityTableElements slot to keep the column
scoped to event definitions. The plugin owns the attribute (id/title/sortable),
the cell component, and the license gate.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* Fix padding-line-between-statements lint

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* Add plugin slots for tactics/techniques detail row and summary

Two new slots on the event-definition / events UI:
- events.components.tacticsTechniquesDetailRow - consumed by the events
  details expanded section to render a row next to Tags.
- eventDefinitions.components.tacticsTechniquesSummary - consumed by the
  event definition summary view to render a row next to Tags.

Server defines the slot contracts; the security plugin contributes the
components, gates them on the security license, and owns the dual-read
between the new tactics_techniques field and the legacy sigma_rule_tag_*
shape.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kingzacko1 kingzacko1 kingzacko1 approved these changes
@zeeklop zeeklop zeeklop approved these changes
@dennisoelkers dennisoelkers Awaiting requested review from dennisoelkers

Assignees

No one assigned

Labels

e2e-tests Run PR build with e2e tests.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@danotorrey @kingzacko1 @zeeklop