[BUG] Tag must start with "attack" when creating detection rule

What is the bug?
When creating a detection rule, an exception is thrown by the create/update rule API if a tag does not start with attack.

How can one reproduce the bug?
Steps to reproduce the behavior:

1. Go to Detection rules page
2. Add below rule yaml in the YAML editor and hit Create

id: OFRhN4wBypPZ_lmJW5Q2
logsource:
  product: dns
title: High DNS Bytes Out cloned
description: High DNS queries bytes amount from host per short period of time
tags:
  - cve.exfiltration
  - attack.t1048.003
falsepositives:
  - >-
    Legitimate high DNS bytes out rate to domain name which should be added to
    whitelist
level: medium
status: experimental
references: []
author: 'Daniil Yugoslavskiy, oscd.community'
detection:
  selection:
    query: '*'
  timeframe: 1m
  condition: selection

What is the expected behavior?
Rule gets created but instead it shows error that tag must start with attack

What is your host/environment?

• Security analytics all versions upto 2.11

Do you have any screenshots?

Do you have any additional context?
N/A