MITRE ATT&CK mapper

This is a deterministic matcher, not an AI classifier: the same text always yields the same suggestions. Technique IDs, Sigma tags, manually added ids and imported layer entries count as high-confidence and start reviewed. Curated incident phrases and verbatim technique names are suggestions only; tick the ones your report stands behind. Revoked ids map to their replacements with a note, and ones with no replacement are dropped with a note instead of guessed. The bundled snapshot tracks retired techniques; it does not carry MITRE's separate deprecated attribute. The v20 split of the old Defense Evasion tactic into Stealth and Defense Impairment applies, so older layers placed under defense-evasion will not match.