Visibility v2: STIX-driven tiered coverage, CIM-aware, remediation + threat ranking

[emerygiles]

Reworks the visibility-vs-detection coverage from a hand-mapped boolean into a production-grade engine, implementing v2 review end-to-end.

What changed

• STIX-driven, not hand-mapped. Technique → telemetry now comes from ATT&CK's own STIX bundle (the v17 detection-strategy/analytic model, which ships concrete log sources like AWS:CloudTrail, WinEventLog:Sysmon, saas:okta). Generalizes to ~600 techniques and survives ATT&CK releases. Built by scripts/build_attack_mapping.py (uses mitreattack-python), cached at backend/data/attack_stix_mapping.json so runtime needs no heavy deps or network.
• Tiered none/partial/good, not boolean — DeTT&CT dimensions (completeness, timeliness, retention, consistency).
• Splunk reality: "have the data source" = onboarded AND CIM-normalized AND within the search window. CIM membership is measured on the live backend via | tstats per CIM data model (SplunkRest.telemetry_posture); the sandbox supplies representative measured posture.
• Remediation on every gap (the concrete Splunk input to onboard / CIM-map).
• Priority queue ranked by a configurable threat profile (backend/threat_profiles.py, THREAT_PROFILE, GET /threat-profiles).
• Production posture: prod-safe AUTO_DEPLOY=false default; old attack_datasources.py removed.
• Frontend VisibilityPanel upgraded to tier chips + CIM data-model posture strip + remediation + priority. tests/test_visibility.py added (7 tests, all passing).

OR vs AND across data sources

OR for "can you see it at all" (any one relevant CIM data model present → some visibility), then weight count + quality of present sources for the tier. A small, documented AND overlay applies for the few techniques with a genuinely necessary primary source e.g. S3 object-exfil (T1537) needs CloudTrail data events; the management plane can't see it, so it's capped at partial even when Change/Auth are healthy. Pure AND invents blind spots; pure OR throws away the quality signal.

Verified

• Backend: /visibility, /threat-profiles (TestClient), full agent loop (recon → tiered visibility → … → propose).
• Frontend: builds clean, renders in-browser (9 good / 3 partial / 0 blind on demo, T1537 floated to top), no console errors.
• python tests/test_visibility.py → 7 passed.