feat: add parsing of Mitre Att&ck tags into threat obj

[rkokkelk]

Description

Elastic uses the threat object for relevant information about relevant threat to SIEM rule. This object can handle Mitre Att&ck references. The functionality added parses the attack tags (e.g. attack.impact / attack.T1496) tags to fill the threat object for Elastic.

Example

            title: Test
            id: c277adc0-f0c4-42e1-af9d-fab062992156
            status: test
            logsource:
                category: test_category
                product: test_product
            detection:
                sel:
                    fieldA: valueA
                    fieldB: valueB
                condition: sel
            tags:
                - attack.impact
                - attack.t1496

Result:

{
        "id": "c277adc0-f0c4-42e1-af9d-fab062992156",
        "name": "SIGMA - Test",
        'tags': [],
        "interval": "5m",
        "enabled": True,
        "description": "No description",
        "risk_score": 21,
        "severity": "low",
        "license": "DRL",
        "output_index": "",
        "meta": {
                "from": "1m",
        },
        "author": [],
        "false_positives": [],
        "from": "now-5m",
        "rule_id": "c277adc0-f0c4-42e1-af9d-fab062992156",
        "max_signals": 100,
        "risk_score_mapping": [],
        "severity_mapping": [],
        "threat": [
            {
                "tactic": {
                    "id": "TA0040",
                    "reference": "https://attack.mitre.org/tactics/TA0040",
                    "name": "Impact"
                },
                "framework": "MITRE ATT&CK",
                "technique": [
                    {
                    "id": "T1496",
                    "reference": "https://attack.mitre.org/techniques/T1496",
                    "name": "Resource Hijacking",
                    "subtechnique": []
                    }
                ]
            }
        ],
        "to": "now",
        "references": [],
        "version": 1,
        "exceptions_list": [],
        "immutable": False,
        "related_integrations": [],
        "required_fields": [],
        "setup": "",
        "type": "query",
        "language": "lucene",
        "index": [
                "apm-*-transaction*",
                "auditbeat-*",
                "endgame-*",
                "filebeat-*",
                "logs-*",
                "packetbeat-*",
                "traces-apm*",
                "winlogbeat-*",
                "-*elastic-cloud-logs-*"
        ],
        "query": "fieldA:valueA AND fieldB:valueB",
        "filters": [],
        "throttle": "no_actions",
        "actions": []
    }