[nastasha-solomon]

Summary

Updates the detection rules API reference so the rule Threat object no longer says that only MITRE ATT&CK is supported. Since 9.6 (#296562, #298185), rules can also carry MITRE ATLAS threat entries.

Related docs PR: elastic/docs-content#9065

What changed

Only the source schema changed: x-pack/solutions/security/plugins/security_solution/common/api/detection_engine/model/rule_schema/common_attributes.schema.yaml.

Field	Before	After
Threat	"Currently, only threats described using the MITRE ATT&CK™ framework are supported."	Threats can be mapped to MITRE ATT&CK or, in 9.6 and later, MITRE ATLAS. Each entry belongs to one framework; don't mix ATT&CK and ATLAS IDs in the same entry.
Threat.framework	"Relevant attack framework"	Lists the supported values MITRE ATT&CK and MITRE ATLAS (9.6 and later), with example IDs. Notes that ATLAS IDs use the AML. prefix.

The framework strings match THREAT_FRAMEWORK_NAME in x-pack/solutions/security/packages/security-mitre-attack-common/src/threat_framework.ts. The example IDs (TA0001, T1566, T1566.001, AML.TA0000, AML.T0044, AML.T0024.002) all exist in the bundled MITRE artifact.

The API does not validate the framework value or reject mixed IDs. The "don't mix" text is usage guidance, matching how #298185 treats it.

Generated files

The derived files were not regenerated locally. CI quick checks (pnpm openapi:generate, pnpm openapi:bundle:detections, make api-docs) are expected to regenerate and auto-commit them:

• common_attributes.gen.ts
• docs/openapi/{ess,serverless}/security_solution_detections_api_2023_10_31.bundled.schema.yaml
• oas_docs/output/*.yaml

Checklist

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations. (N/A: description-only change, no schema shape change)
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Identify risks

None. This only changes OpenAPI descriptions; it doesn't change validation, types, or runtime behavior.

🤖 Generated with Claude Code

[infra-vault-gh-plugin-prod]

🤖 Jobs for this PR can be triggered through checkboxes. 🚧

ℹ️ To trigger the CI, please tick the checkbox below 👇

• Click to trigger kibana-pull-request for this PR!
• Click to trigger kibana-deploy-project-from-pr for this PR!
• Click to trigger kibana-deploy-cloud-from-pr for this PR!
• Click to trigger kibana-entity-store-performance-from-pr for this PR!
• Click to trigger kibana-storybooks-from-pr for this PR!