[Security][9.5 & Serverless] Adds guide for remapping detection rules to MITRE ATT&CK v19

[nastasha-solomon]

Summary

MITRE ATT&CK v19 retires the Defense Evasion tactic, splitting it into Stealth and Defense Impairment and restructuring several techniques underneath it (most notably Impair Defenses / T1562). This PR adds a new guide for remapping custom rules affected by that change, and updates the surrounding docs to point to it.

Closes #7257

Previews

• Remap detection rules to MITRE ATT&CK v19 - New page that explains what's changed in MITRE ATT&CK v19 and provides steps for identifying and remapping outdated rules.
• MITRE ATT&CK coverage | Supported MITRE ATT&CK versions - Updated table, which was confusing to read and had missing versions. Also added a note pointing readers with custom rule mappings to the new remap guide.
• Common rule settings - Add a note under MITRE ATT&CK threats clarifying that the mapping picker only offers the currently-supported ATT&CK version, linking to the remap guide for anyone hitting version-change issues

Generative AI disclosure

1. Did you use a generative AI (GenAI) tool to assist in creating this contribution?

• Yes - Cursor + Claude
• No

[github-actions]

Elastic Docs AI PR menu

Check the box to run an AI review for this pull request.

• Review docs changes (docs-review). Status: not started.

Powered by GitHub Agentic Workflows and docs-actions. For more information, reach out to the docs team.

[github-actions]

Elastic Docs Style Checker (Vale)

Summary: 3 suggestions found

💡 Suggestions (3): Optional style improvements. Apply when helpful.

File	Line	Rule	Message
solutions/security/detect-and-alert/remap-mitre-attack.md	36	Elastic.WordChoice	Consider using 'deactivate, deselect, hide, turn off' instead of 'Disable', unless the term is in the UI.
solutions/security/detect-and-alert/remap-mitre-attack.md	36	Elastic.WordChoice	Consider using 'deactivate, deselect, hide, turn off' instead of 'Disable', unless the term is in the UI.
solutions/security/detect-and-alert/remap-mitre-attack.md	96	Elastic.Versions	Use 'and later' instead of 'and newer' when referring to versions.

---

The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

[github-actions]

🔍 Preview links for changed docs

• solutions/security/detect-and-alert/common-rule-settings.md
• solutions/security/detect-and-alert/mitre-attack-coverage.md
• solutions/security/detect-and-alert/remap-mitre-attack.md

[dplumlee]

This all looks good @nastasha-solomon! Just had one nit about versioning specificity.

[bmorelli25]

nice job

[approksiu]

Thanks, left a few suggestions.