[nastasha-solomon]

Summary

Fixes elastic/docs-content-internal#1941.
Fixes elastic/docs-content-internal#1942.

This PR has two parts:

• MITRE ATLAS and 9.6 changes: Documents what's new in 9.6. These changes are tagged for 9.6 and serverless, and the 9.5 names, labels, and callout stay in the docs for readers on earlier versions.
• Content and organization improvements: Fixes that aren't tied to 9.6 and apply to every version, mostly on the MITRE coverage page.

MITRE ATLAS and 9.6 changes

In 9.6:

• The MITRE ATT&CK® coverage page is renamed MITRE coverage, and a new MITRE ATLAS tab shows how your rules cover attacks on AI and machine learning systems.
• The rule's Threat mappings setting replaces MITRE ATT&CK™ threats, and you can add MITRE ATLAS as a second framework.
• The bundled MITRE ATT&CK version moves from v19.1 to v19.2.
• The MITRE ATT&CK® updated to v19 callout is removed from the Detection rules page.

Preview:

• MITRE coverage - New page name, with a note for the 9.0 to 9.5 name, and a screenshot of the 9.6 page. A new View MITRE ATLAS coverage section names the supported MITRE ATLAS version and explains how rules get onto the tab. The supported versions table adds v19.2 for 9.6 and serverless.
• Common rule settings - New Threat mappings setting. The MITRE ATT&CK® threats entry stays for 9.0 to 9.5 and is marked unavailable in serverless.
• View detection alert details - The flyout field is now Threat mappings.
• Manage detection rules - Adds search by MITRE ATLAS name or ID.
• Remap detection rules to MITRE ATT&CK v19 - The Detection rules page callout is tagged 9.5 only and marked unavailable in serverless. The steps no longer name the mapping field, since it's renamed in 9.6.
• Security use cases and Built-in skills reference - The detection-rule-edit skill now edits "MITRE mappings" instead of "MITRE ATT&CK mappings", and the use cases page adds a MITRE ATLAS example prompt.
• Detections and alerts, Install prebuilt rules, and Elastic Security UI - Links use the new page name.

Content and organization improvements

• MITRE coverage - Rewritten around what users go there to do: find gaps in their detection coverage and close them.
  • The intro states the page's purpose, and the coverage grid is explained before other sections refer to it.
  • Headings say what you get, and the sections follow the workflow. The technique popup section now comes before the enable section that uses it.
  • Passages that described how the page works internally now describe what users see and can do next. This covers the filters, search, and expanded cells, plus what to check when a rule is missing.
  • Adds the privileges needed to view the page and to enable rules from it.
  • The enable section notes that Enable all disabled needs Disabled rules in the filter, and corrects that filter's name from Not enabled rules.
• Remap detection rules to MITRE ATT&CK v19 - Headings state what changed and what to do, and coverage page mentions are now links.
• Manage detection rules and Install prebuilt rules - Stop recommending the Defense Evasion tactic, which MITRE ATT&CK v19 retires. Manage detection rules uses a different search example. Install prebuilt rules suggests Stealth and Defense Impairment as starting tactics, and keeps Defense Evasion for versions that use an earlier MITRE ATT&CK version.
• All changed pages - Adds trademark symbols to the first mention of MITRE ATT&CK® and MITRE ATLAS®, following MITRE's branding guidance. The 9.0 to 9.5 UI labels now include the symbols Kibana shows, such as MITRE ATT&CK® threats.

Verification

The 9.6 labels, versions, and behavior were checked against Kibana's 9.6 branch, which carries elastic/kibana#292796, elastic/kibana#296562, and elastic/kibana#298185. The behavior described in the coverage page rewrite was checked against Kibana main and the v9.0.0 tag. That includes the default filter, cell shading, search matching, and popup contents. The outdated mappings callout was checked against the v9.4.0 and v9.5.0 tags.

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes - Claude Opus 5.5, via Claude Code and Cursor

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[github-actions]

🔍 Preview links for changed docs

• explore-analyze/ai-features/agent-builder/builtin-skills-reference.md
• solutions/security/ai/agent-builder/skills-use-cases.md
• solutions/security/detect-and-alert.md
• solutions/security/detect-and-alert/common-rule-settings.md
• solutions/security/detect-and-alert/install-prebuilt-rules.md
• solutions/security/detect-and-alert/manage-detection-rules.md
• solutions/security/detect-and-alert/mitre-attack-coverage.md
• solutions/security/detect-and-alert/remap-mitre-attack.md
• solutions/security/detect-and-alert/view-detection-alert-details.md
• solutions/security/get-started/elastic-security-ui.md

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 2 suggestions found

💡 Suggestions (2): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
solutions/security/detect-and-alert/mitre-attack-coverage.md	87	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'Disabled', unless the term is in the UI.
solutions/security/detect-and-alert/mitre-attack-coverage.md	93	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[dplumlee]

This will be changed before release to v2026.09. This is TRADE's PR and we will have one up too.

ATT&CK mappings will be on v20.1 if they come out in time, I'll keep you updated but here is the coordinating ticket as well: elastic/kibana#166152

[nastasha-solomon]

Suggested change

	To view the coverage grid for MITRE ATLAS [v2026.08](https://github.com/mitre-atlas/atlas-data/releases/tag/v2026.08), select the **MITRE ATLAS** tab. If a rule is mapped to both frameworks, it counts toward coverage on both tabs.
	To view the coverage grid for MITRE ATLAS [v2026.09](https://github.com/mitre-atlas/atlas-data/releases/tag/v2026.08), select the **MITRE ATLAS** tab. If a rule is mapped to both frameworks, it counts toward coverage on both tabs.

[bmorelli25]

Super easy to follow. I learned something new!

[mdbirnstiehl]

One question, but otherwise LGTM!