[FR] Add sub-technique data to the summary-xlsx

[eric-forte-elastic]

Pull Request

Issue link(s):

Resolves #2078

Summary - What I changed

Small change to align the package summary.xlsx Summary tab with MITRE's technique / sub-technique distinction, and fixes a mismatched-units percentage in the same sheet.

Note

An alternative is to remove the spreadsheet generation all together. While it is built in each package, it is not shipped to customers via EPR.

How To Test

Build a package using one of the variety of methods e.g. python -m detection_rules dev build-release

Or to save a bit of time, use a python script to build a package like below.

source env/detection-rules-build/bin/activate

python -c "
from pathlib import Path
from detection_rules.packaging import Package
from detection_rules.rule_loader import RuleCollection

rules = RuleCollection.default()
pkg = Package(rules=rules, name='issue-2078-smoke', verbose=False)
out = Path('/tmp/issue-2078-summary.xlsx')
pkg.generate_xslx(str(out))
print(f'wrote {out} ({out.stat().st_size} bytes)')
"

The result should be akin to the following:

issue-2078-summary.xlsx

Checklist

• Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
• Added the meta:rapid-merge label if planning to merge within 24 hours
• Secret and sensitive material has been managed correctly
• Automated testing was updated or added to match the most common scenarios
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?

[github-actions]

Bug - Guidelines

These guidelines serve as a reminder set of considerations when addressing a bug in the code.

Documentation and Context

• Provide detailed documentation (description, screenshots, reproducing the bug, etc.) of the bug if not already documented in an issue.
• Include additional context or details about the problem.
• Ensure the fix includes necessary updates to the release documentation and versioning.

Code Standards and Practices

• Code follows established design patterns within the repo and avoids duplication.
• Ensure that the code is modular and reusable where applicable.

Testing

• New unit tests have been added to cover the bug fix or edge cases.
• Existing unit tests have been updated to reflect the changes.
• Provide evidence of testing and detecting the bug fix (e.g., test logs, screenshots).
• Validate that any rules affected by the bug are correctly updated.
• Ensure that performance is not negatively impacted by the changes.
• Verify that any release artifacts are properly generated and tested.
• Conducted system testing, including fleet, import, and create APIs (e.g., run make test-cli, make test-remote-cli, make test-hunting-cli)

Additional Checks

• Verify that the bug fix works across all relevant environments (e.g., different OS versions).
• Confirm that the proper version label is applied to the PR patch, minor, major.

[shashank-elastic]

Tested Locally works as expected

[Mikaayenson]

🚀