diff --git a/Detection/context_providers/policy_store_server.py b/Detection/context_providers/policy_store_server.py index f3684ec9..cc937be1 100644 --- a/Detection/context_providers/policy_store_server.py +++ b/Detection/context_providers/policy_store_server.py @@ -63,6 +63,9 @@ def search_policies(keywords: List[str]) -> Dict[str, Any]: for policy in policies: # Search in policy text fields policy_text = f"{policy.get('name', '')} {policy.get('description', '')}" + # The policy store keeps each policy's main text under `policy`. + if policy.get('policy'): + policy_text += " " + str(policy['policy']) if policy.get('requirements'): policy_text += " " + " ".join(policy.get('requirements', [])) diff --git a/Detection/tests/test_policy_store.py b/Detection/tests/test_policy_store.py index c4d59b87..2449dc6a 100644 --- a/Detection/tests/test_policy_store.py +++ b/Detection/tests/test_policy_store.py @@ -12,3 +12,30 @@ def test_load_empty_yaml_returns_safe_default(): with patch("builtins.open", mock_open(read_data="")): result = policy_store_server.load_policy_data() assert result == {"policies": []} + + +def test_search_policies_matches_policy_body(): + """Keywords that only appear in a policy's body text must still match.""" + policies = [ + { + "name": "Access Control Standard", + "description": "Security requirements for access management", + "category": "access_control", + "policy": "The policy enforces the principle of least privilege.", + }, + { + "name": "Anti-malware Standard", + "description": "Anti-malware requirements", + "category": "malware_protection", + "policy": "All systems must run approved anti-malware software.", + }, + ] + with patch.dict(policy_store_server.policy_data, {"policies": policies}): + result = policy_store_server.search_policies(["least privilege"]) + assert [p["name"] for p in result["matching_policies"]] == ["Access Control Standard"] + + +def test_shipped_policy_store_body_is_searchable(): + """The shipped policy store keeps its main text under `policy`.""" + result = policy_store_server.search_policies(["least privilege"]) + assert result["total_matches"] > 0