Add tactics_techniques field on event definitions

graylog-storage-elasticsearch7/src/main/java/org/graylog/storage/elasticsearch7/MoreSearchAdapterES7.java

@@ -22,6 +22,7 @@
 import jakarta.inject.Named;
 import org.graylog.events.event.EventDto;
 import org.graylog.events.processor.EventProcessorException;
+import org.graylog.events.search.MitreBackwardsCompatibilityFilter;
 import org.graylog.events.search.MoreSearch;
 import org.graylog.events.search.MoreSearchAdapter;
 import org.graylog.events.search.SourceStreamFilter;
@@ -228,7 +229,17 @@ private QueryBuilder createQuery(String queryString, TimeRange timerange, Set<St
                 .filter(termsQuery(EventDto.FIELD_STREAMS, eventStreams))
                 .filter(requireNonNull(TimeRangeQueryFactory.create(timerange)));
 
-        extraFilters.forEach((field, values) -> {
+        final BoolQueryBuilder mitreOr = boolQuery().minimumShouldMatch(1);
+        if (MitreBackwardsCompatibilityFilter.emitShouldClauses(extraFilters,
+                (k, v) -> mitreOr.should(buildExtraFilter(k, v)))) {
+            filter.filter(mitreOr);
+        }
+
+        extraFilters.entrySet().stream()
+                .filter(e -> !MitreBackwardsCompatibilityFilter.isMitreKey(e.getKey()))
+                .forEach(e -> {
+            final var field = e.getKey();
+            final var values = e.getValue();
             values.stream()
                     .filter(MoreSearchAdapter::isRangeValue)
                     .map(value -> buildExtraFilter(field, value))

graylog-storage-opensearch2/src/main/java/org/graylog/storage/opensearch2/MoreSearchAdapterOS2.java

@@ -22,6 +22,7 @@
 import jakarta.inject.Named;
 import org.graylog.events.event.EventDto;
 import org.graylog.events.processor.EventProcessorException;
+import org.graylog.events.search.MitreBackwardsCompatibilityFilter;
 import org.graylog.events.search.MoreSearch;
 import org.graylog.events.search.MoreSearchAdapter;
 import org.graylog.events.search.SourceStreamFilter;
@@ -229,7 +230,17 @@ private QueryBuilder createQuery(String queryString, TimeRange timerange, Set<St
                 .filter(termsQuery(EventDto.FIELD_STREAMS, eventStreams))
                 .filter(requireNonNull(TimeRangeQueryFactory.create(timerange)));
 
-        extraFilters.forEach((field, values) -> {
+        final BoolQueryBuilder mitreOr = boolQuery().minimumShouldMatch(1);
+        if (MitreBackwardsCompatibilityFilter.emitShouldClauses(extraFilters,
+                (k, v) -> mitreOr.should(buildExtraFilter(k, v)))) {
+            filter.filter(mitreOr);
+        }
+
+        extraFilters.entrySet().stream()
+                .filter(e -> !MitreBackwardsCompatibilityFilter.isMitreKey(e.getKey()))
+                .forEach(e -> {
+            final var field = e.getKey();
+            final var values = e.getValue();
             values.stream()
                     .filter(MoreSearchAdapter::isRangeValue)
                     .map(value -> buildExtraFilter(field, value))

graylog-storage-opensearch3/src/main/java/org/graylog/storage/opensearch3/MoreSearchAdapterOS.java

@@ -21,6 +21,7 @@
 import jakarta.inject.Named;
 import org.graylog.events.event.EventDto;
 import org.graylog.events.processor.EventProcessorException;
+import org.graylog.events.search.MitreBackwardsCompatibilityFilter;
 import org.graylog.events.search.MoreSearch;
 import org.graylog.events.search.MoreSearchAdapter;
 import org.graylog.events.search.SourceStreamFilter;
@@ -164,7 +165,17 @@ private Query createQuery(String queryString, TimeRange timerange, Set<String> e
         boolQuery.filter(timerangeQuery(timerange));
 
 
-        extraFilters.forEach((field, values) -> {
+        final BoolQuery.Builder mitreOr = BoolQuery.builder().minimumShouldMatch("1");
+        if (MitreBackwardsCompatibilityFilter.emitShouldClauses(extraFilters,
+                (k, v) -> mitreOr.should(buildExtraFilter(k, v)))) {
+            boolQuery.filter(Query.of(b -> b.bool(mitreOr.build())));
+        }
+
+        extraFilters.entrySet().stream()
+                .filter(e -> !MitreBackwardsCompatibilityFilter.isMitreKey(e.getKey()))
+                .forEach(e -> {
+            final var field = e.getKey();
+            final var values = e.getValue();
             values.stream()
                     .filter(MoreSearchAdapter::isRangeValue)
                     .map(value -> buildExtraFilter(field, value))

graylog2-server/src/main/java/org/graylog/events/EventsModule.java

@@ -52,6 +52,7 @@
 import org.graylog.events.processor.EventProcessorExecutionJob;
 import org.graylog.events.processor.EventProcessorExecutionMetrics;
 import org.graylog.events.processor.EventResolver;
+import org.graylog.events.processor.TacticsTechniquesValidator;
 import org.graylog.events.processor.aggregation.AggregationEventProcessor;
 import org.graylog.events.processor.aggregation.AggregationEventProcessorConfig;
 import org.graylog.events.processor.aggregation.AggregationEventProcessorParameters;
@@ -99,6 +100,9 @@ protected void configure() {
         OptionalBinder.newOptionalBinder(binder(), EventResolver.class)
                 .setDefault().to(DefaultEventResolver.class);
 
+        OptionalBinder.newOptionalBinder(binder(), TacticsTechniquesValidator.class)
+                .setDefault().to(TacticsTechniquesValidator.NoOp.class);
+
         addSystemRestResource(AvailableEntityTypesResource.class);
         addSystemRestResource(EventDefinitionsResource.class);
         addSystemRestResource(EventNotificationsResource.class);

graylog2-server/src/main/java/org/graylog/events/contentpack/entities/EventDefinitionEntity.java

@@ -67,6 +67,7 @@ public abstract class EventDefinitionEntity extends ScopedContentPackEntity impl
     private static final String MATCHED_AT = "matched_at";
     private static final String FIELD_EVENT_PROCEDURE = "event_procedure";
     private static final String FIELD_EVENT_SUMMARY_TEMPLATE = "event_summary_template";
+    private static final String FIELD_TACTICS_TECHNIQUES = EventDefinitionDto.FIELD_TACTICS_TECHNIQUES;
 
     @JsonProperty(FIELD_TITLE)
     public abstract ValueReference title();
@@ -124,6 +125,9 @@ public abstract class EventDefinitionEntity extends ScopedContentPackEntity impl
     @JsonProperty(FIELD_EVENT_SUMMARY_TEMPLATE)
     public abstract ValueReference eventSummaryTemplate();
 
+    @JsonProperty(FIELD_TACTICS_TECHNIQUES)
+    public abstract ImmutableList<String> tacticsTechniques();
+
     public static Builder builder() {
         return Builder.create();
     }
@@ -136,6 +140,7 @@ public static abstract class Builder extends ScopedContentPackEntity.AbstractBui
         public static Builder create() {
             return new AutoValue_EventDefinitionEntity.Builder()
                     .isScheduled(ValueReference.of(true))
+                    .tacticsTechniques(ImmutableList.of())
                     .tags(ImmutableSet.of());
         }
 
@@ -190,6 +195,9 @@ public static Builder create() {
         @JsonProperty(FIELD_EVENT_SUMMARY_TEMPLATE)
         public abstract Builder eventSummaryTemplate(ValueReference eventSummaryTemplate);
 
+        @JsonProperty(FIELD_TACTICS_TECHNIQUES)
+        public abstract Builder tacticsTechniques(ImmutableList<String> tacticsTechniques);
+
         public abstract EventDefinitionEntity build();
     }
 
@@ -230,6 +238,7 @@ public EventDefinitionDto toNativeEntity(Map<String, ValueReference> parameters,
                 .tags(tags())
                 .eventProcedureId(procedureId)
                 .eventSummaryTemplate(eventSummaryTemplate() != null ? eventSummaryTemplate().asString(parameters) : null)
+                .tacticsTechniques(tacticsTechniques())
                 .build();
     }
 

graylog2-server/src/main/java/org/graylog/events/event/Event.java

@@ -113,6 +113,10 @@ public interface Event extends Indexable {
 
     void addAssociatedAssets(Set<String> associatedAssets);
 
+    List<String> getTacticsTechniques();
+
+    void setTacticsTechniques(List<String> tacticsTechniques);
+
     Set<String> getTags();
 
     void setTags(Set<String> tags);
@@ -135,6 +139,7 @@ static Event fromDto(EventDto from) {
         from.timerangeEnd().ifPresent(event::setTimerangeEnd);
         from.originContext().ifPresent(event::setOriginContext);
         from.replayInfo().ifPresent(event::setReplayInfo);
+        event.setTacticsTechniques(from.tacticsTechniques());
         event.setTags(from.tags());
 
         return event;

graylog2-server/src/main/java/org/graylog/events/event/EventDto.java

@@ -21,6 +21,7 @@
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
 import com.google.auto.value.AutoValue;
+import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 import org.joda.time.DateTime;
@@ -57,6 +58,7 @@ public abstract class EventDto {
     public static final String FIELD_GROUP_BY_FIELDS = "group_by_fields";
     public static final String FIELD_AGGREGATION_CONDITIONS = "aggregation_conditions";
     public static final String FIELD_REPLAY_INFO = "replay_info";
+    public static final String FIELD_TACTICS_TECHNIQUES = "tactics_techniques";
 
     @JsonProperty(FIELD_ID)
     public abstract String id();
@@ -129,6 +131,9 @@ public abstract class EventDto {
     @JsonProperty(FIELD_REPLAY_INFO)
     public abstract Optional<EventReplayInfo> replayInfo();
 
+    @JsonProperty(FIELD_TACTICS_TECHNIQUES)
+    public abstract List<String> tacticsTechniques();
+
     public static Builder builder() {
         return Builder.create();
     }
@@ -148,6 +153,7 @@ public static Builder create() {
                     .aggregationConditions(ImmutableMap.of())
                     .scores(ImmutableMap.of())
                     .associatedAssets(ImmutableSet.of())
+                    .tacticsTechniques(ImmutableList.of())
                     .tags(ImmutableSet.of());
         }
 
@@ -224,6 +230,9 @@ public static Builder create() {
         @JsonProperty(FIELD_REPLAY_INFO)
         public abstract Builder replayInfo(@Nullable EventReplayInfo replayInfo);
 
+        @JsonProperty(FIELD_TACTICS_TECHNIQUES)
+        public abstract Builder tacticsTechniques(List<String> tacticsTechniques);
+
         public abstract EventDto build();
     }
 }

graylog2-server/src/main/java/org/graylog/events/event/EventImpl.java

@@ -67,6 +67,7 @@ public class EventImpl implements Event {
     private final Set<String> associatedAssets = new HashSet<>();
     private final Set<String> tags = new HashSet<>();
     private EventReplayInfo replayInfo;
+    private List<String> tacticsTechniques = ImmutableList.of();
 
     EventImpl(String eventId,
               DateTime eventTimestamp,
@@ -339,6 +340,16 @@ public void setReplayInfo(EventReplayInfo replayInfo) {
         this.replayInfo = replayInfo;
     }
 
+    @Override
+    public List<String> getTacticsTechniques() {
+        return tacticsTechniques;
+    }
+
+    @Override
+    public void setTacticsTechniques(List<String> tacticsTechniques) {
+        this.tacticsTechniques = tacticsTechniques == null ? ImmutableList.of() : ImmutableList.copyOf(tacticsTechniques);
+    }
+
     @Override
     public EventDto toDto() {
         final Map<String, String> fields = this.fields.entrySet()
@@ -375,6 +386,7 @@ public EventDto toDto() {
                 .groupByFields(ImmutableMap.copyOf(groupByFields))
                 .aggregationConditions(ImmutableMap.copyOf(aggregationConditions))
                 .replayInfo(getReplayInfo())
+                .tacticsTechniques(getTacticsTechniques())
                 .build();
     }
 
@@ -431,6 +443,7 @@ public boolean equals(Object o) {
                 Objects.equals(scores, event.scores) &&
                 Objects.equals(associatedAssets, event.associatedAssets) &&
                 Objects.equals(tags, event.tags) &&
+                Objects.equals(tacticsTechniques, event.tacticsTechniques) &&
                 Objects.equals(replayInfo, event.replayInfo);
     }
 
@@ -439,7 +452,7 @@ public int hashCode() {
         return Objects.hash(eventId, eventDefinitionType, eventDefinitionId, originContext, eventTimestamp,
                 processingTimestamp, timerangeStart, timerangeEnd, streams, sourceStreams, message, source,
                 keyTuple, priority, alert, fields, groupByFields, aggregationConditions, scores,
-                associatedAssets, tags, replayInfo);
+                associatedAssets, tags, tacticsTechniques, replayInfo);
     }
 
     @Override
@@ -467,6 +480,7 @@ public String toString() {
                 .add("scores", scores)
                 .add("associatedAssets", associatedAssets)
                 .add("tags", tags)
+                .add("tacticsTechniques", tacticsTechniques)
                 .toString();
     }
 

graylog2-server/src/main/java/org/graylog/events/event/EventProcessorEventFactory.java

@@ -65,6 +65,7 @@ public Event createEvent(EventDefinition eventDefinition, DateTime eventTime, St
                 eventDefinition.priority(),
                 eventDefinition.alert()
         );
+        event.setTacticsTechniques(eventDefinition.tacticsTechniques());
         event.setTags(eventDefinition.tags());
         return event;
     }

graylog2-server/src/main/java/org/graylog/events/processor/EventDefinition.java

@@ -103,4 +103,8 @@ default String eventProcedureId() {
     default String eventSummaryTemplate() {
         return null;
     }
+
+    default ImmutableList<String> tacticsTechniques() {
+        return ImmutableList.of();
+    }
 }

graylog2-server/src/main/java/org/graylog/events/processor/EventDefinitionConfiguration.java

@@ -31,7 +31,22 @@ public class EventDefinitionConfiguration {
     @Parameter(value = "event_definition_max_event_limit", validators = PositiveIntegerValidator.class)
     private int maxEventLimit = 1000;
 
+    @Documentation("""
+            Enforce strict format validation on tactic/technique IDs assigned to event definitions.
+            When enabled, tactic IDs must match the pattern TA followed by 4 digits (e.g. TA0004) and
+            technique IDs must match T followed by 4 digits with an optional 3-digit sub-technique
+            suffix (e.g. T1021 or T1021.006). Disable as an emergency override if a new ID format is
+            introduced before Graylog ships an updated validator.
+            Default: true
+            """)
+    @Parameter(value = "event_definition_tactics_techniques_validation_enabled")
+    private boolean tacticsTechniquesValidationEnabled = true;
+
     public int getMaxEventLimit() {
         return maxEventLimit;
     }
+
+    public boolean isTacticsTechniquesValidationEnabled() {
+        return tacticsTechniquesValidationEnabled;
+    }
 }

graylog2-server/src/main/java/org/graylog/events/processor/EventDefinitionDto.java

@@ -75,6 +75,8 @@ public abstract class EventDefinitionDto implements EventDefinition, ContentPack
     public static final String FIELD_PRIORITY = "priority";
     public static final String FIELD_ALERT = "alert";
     public static final String FIELD_CONFIG = "config";
+    public static final String FIELD_TACTICS_TECHNIQUES = "tactics_techniques";
+    public static final int MAX_TACTICS_TECHNIQUES = 64;
     public static final String FIELD_TAGS = "tags";
     public static final int MAX_TAG_LENGTH = 128;
     public static final int MAX_TAGS = 64;
@@ -172,6 +174,10 @@ public abstract class EventDefinitionDto implements EventDefinition, ContentPack
     @JsonProperty(FIELD_EVENT_SUMMARY_TEMPLATE)
     public abstract String eventSummaryTemplate();
 
+    @Override
+    @JsonProperty(FIELD_TACTICS_TECHNIQUES)
+    public abstract ImmutableList<String> tacticsTechniques();
+
     public static Builder builder() {
         return Builder.create();
     }
@@ -209,6 +215,21 @@ public ValidationResult validate(@Nullable EventDefinitionDto oldEventDefinition
             validation.addError(FIELD_KEY_SPEC, "Event Definition key_spec can only contain fields defined in field_spec.");
         }
 
+        if (tacticsTechniques().size() > MAX_TACTICS_TECHNIQUES) {
+            validation.addError(FIELD_TACTICS_TECHNIQUES, "Event Definition cannot have more than " + MAX_TACTICS_TECHNIQUES + " tactics/techniques.");
+        }
+        if (eventDefinitionConfiguration.isTacticsTechniquesValidationEnabled()) {
+            final List<String> invalidIds = tacticsTechniques().stream()
+                    .filter(id -> !TacticsTechniquesNormalizer.isValid(id))
+                    .toList();
+            if (!invalidIds.isEmpty()) {
+                final String quoted = invalidIds.stream().map(id -> "\"" + id + "\"").collect(Collectors.joining(", "));
+                validation.addError(FIELD_TACTICS_TECHNIQUES,
+                        "Invalid tactic/technique ID" + (invalidIds.size() > 1 ? "s" : "") + ": " + quoted
+                                + ". Expected format: TA0000, T0000, or T0000.000.");
+            }
+        }
+
         if (tags().stream().anyMatch(tag -> tag.length() > MAX_TAG_LENGTH)) {
             validation.addError(FIELD_TAGS, "Event Definition tags cannot exceed " + MAX_TAG_LENGTH + " characters.");
         }
@@ -234,6 +255,7 @@ public static Builder create() {
                     .fieldSpec(ImmutableMap.of())
                     .notifications(ImmutableList.of())
                     .storage(ImmutableList.of())
+                    .tacticsTechniques(ImmutableList.of())
                     .tags(ImmutableSet.of())
                     .state(EventDefinition.State.DISABLED);
         }
@@ -305,12 +327,18 @@ public static Builder create() {
         @JsonProperty(FIELD_EVENT_SUMMARY_TEMPLATE)
         public abstract Builder eventSummaryTemplate(@Nullable String eventSummaryTemplate);
 
+        @JsonProperty(FIELD_TACTICS_TECHNIQUES)
+        public abstract Builder tacticsTechniques(ImmutableList<String> tacticsTechniques);
+
         abstract ImmutableSet<String> tags();
 
+        abstract ImmutableList<String> tacticsTechniques();
+
         abstract EventDefinitionDto autoBuild();
 
         public EventDefinitionDto build() {
             tags(TagNormalizer.normalize(tags()));
+            tacticsTechniques(TacticsTechniquesNormalizer.normalize(tacticsTechniques()));
             final EventDefinitionDto dto = autoBuild();
             final PersistToStreamsStorageHandler.Config withSystemEventsStream = PersistToStreamsStorageHandler.Config.createWithSystemEventsStream();
             if (dto.storage().stream().anyMatch(withSystemEventsStream::equals)) {
@@ -368,6 +396,7 @@ public EventDefinitionEntity toContentPackEntity(EntityDescriptorIds entityDescr
                 .tags(tags())
                 .eventProcedureId(ValueReference.ofNullable(procedureDescriptorId))
                 .eventSummaryTemplate(ValueReference.ofNullable(eventSummaryTemplate()))
+                .tacticsTechniques(tacticsTechniques())
                 .build();
     }