From 7b5bb0e578e65dd570aa5645c80b4b0f0e91625d Mon Sep 17 00:00:00 2001
From: Nicholas Berlin <56366649+nicholasberlin@users.noreply.github.com>
Date: Mon, 4 May 2026 09:40:59 -0400
Subject: [PATCH] Fix Linux and macOS behavior alert custom doc for
 subtechnique fields (#740)

Some rules emit populated threat.technique.subtechnique.{id,name,reference}
fields. The Linux and macOS malicious_behavior_alert custom_documentation
only listed the parent threat.technique.subtechnique path, causing the EAF
custom-documentation validator to fail with undocumented keys. Mirrors the
shape already present in the Windows alert (PR #614 era).

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
(cherry picked from commit 332151dc32820f68e6014d80baf0080e48486914)
---
 .../endpoint/alerts/linux/linux_malicious_behavior_alert.md    | 3 +++
 .../endpoint/alerts/macos/macos_malicious_behavior_alert.md    | 3 +++
 .../alerts/linux/linux_malicious_behavior_alert.yaml           | 3 +++
 .../alerts/macos/macos_malicious_behavior_alert.yaml           | 3 +++
 4 files changed, 12 insertions(+)

diff --git a/custom_documentation/doc/endpoint/alerts/linux/linux_malicious_behavior_alert.md b/custom_documentation/doc/endpoint/alerts/linux/linux_malicious_behavior_alert.md
index 4706516b2..d4a7b0409 100644
--- a/custom_documentation/doc/endpoint/alerts/linux/linux_malicious_behavior_alert.md
+++ b/custom_documentation/doc/endpoint/alerts/linux/linux_malicious_behavior_alert.md
@@ -111,6 +111,9 @@ This alert is generated when a Malicious Behavior alert occurs.
 | threat.technique.name |
 | threat.technique.reference |
 | threat.technique.subtechnique |
+| threat.technique.subtechnique.id |
+| threat.technique.subtechnique.name |
+| threat.technique.subtechnique.reference |
 | user.Ext.real.id |
 | user.Ext.real.name |
 | user.id |
diff --git a/custom_documentation/doc/endpoint/alerts/macos/macos_malicious_behavior_alert.md b/custom_documentation/doc/endpoint/alerts/macos/macos_malicious_behavior_alert.md
index c3601b527..27517de50 100644
--- a/custom_documentation/doc/endpoint/alerts/macos/macos_malicious_behavior_alert.md
+++ b/custom_documentation/doc/endpoint/alerts/macos/macos_malicious_behavior_alert.md
@@ -98,6 +98,9 @@ This alert is generated when a Malicious Behavior alert occurs.
 | threat.technique.name |
 | threat.technique.reference |
 | threat.technique.subtechnique |
+| threat.technique.subtechnique.id |
+| threat.technique.subtechnique.name |
+| threat.technique.subtechnique.reference |
 | user.Ext.real.id |
 | user.Ext.real.name |
 | user.id |
diff --git a/custom_documentation/src/endpoint/data_stream/alerts/linux/linux_malicious_behavior_alert.yaml b/custom_documentation/src/endpoint/data_stream/alerts/linux/linux_malicious_behavior_alert.yaml
index 61d1ea637..1494bb99e 100644
--- a/custom_documentation/src/endpoint/data_stream/alerts/linux/linux_malicious_behavior_alert.yaml
+++ b/custom_documentation/src/endpoint/data_stream/alerts/linux/linux_malicious_behavior_alert.yaml
@@ -116,6 +116,9 @@ fields:
   - threat.technique.name
   - threat.technique.reference
   - threat.technique.subtechnique
+  - threat.technique.subtechnique.id
+  - threat.technique.subtechnique.name
+  - threat.technique.subtechnique.reference
   - user.Ext.real.id
   - user.Ext.real.name
   - user.id
diff --git a/custom_documentation/src/endpoint/data_stream/alerts/macos/macos_malicious_behavior_alert.yaml b/custom_documentation/src/endpoint/data_stream/alerts/macos/macos_malicious_behavior_alert.yaml
index afebb3fa8..7e62a9da7 100644
--- a/custom_documentation/src/endpoint/data_stream/alerts/macos/macos_malicious_behavior_alert.yaml
+++ b/custom_documentation/src/endpoint/data_stream/alerts/macos/macos_malicious_behavior_alert.yaml
@@ -103,6 +103,9 @@ fields:
   - threat.technique.name
   - threat.technique.reference
   - threat.technique.subtechnique
+  - threat.technique.subtechnique.id
+  - threat.technique.subtechnique.name
+  - threat.technique.subtechnique.reference
   - user.Ext.real.id
   - user.Ext.real.name
   - user.id