fix(detection): search policy body text in search_policies

Detection/context_providers/policy_store_server.py

@@ -63,6 +63,9 @@ def search_policies(keywords: List[str]) -> Dict[str, Any]:
     for policy in policies:
         # Search in policy text fields
         policy_text = f"{policy.get('name', '')} {policy.get('description', '')}"
+        # The policy store keeps each policy's main text under `policy`.
+        if policy.get('policy'):
+            policy_text += " " + str(policy['policy'])
         if policy.get('requirements'):
             policy_text += " " + " ".join(policy.get('requirements', []))
 

Detection/tests/test_policy_store.py

@@ -12,3 +12,30 @@ def test_load_empty_yaml_returns_safe_default():
         with patch("builtins.open", mock_open(read_data="")):
             result = policy_store_server.load_policy_data()
     assert result == {"policies": []}
+
+
+def test_search_policies_matches_policy_body():
+    """Keywords that only appear in a policy's body text must still match."""
+    policies = [
+        {
+            "name": "Access Control Standard",
+            "description": "Security requirements for access management",
+            "category": "access_control",
+            "policy": "The policy enforces the principle of least privilege.",
+        },
+        {
+            "name": "Anti-malware Standard",
+            "description": "Anti-malware requirements",
+            "category": "malware_protection",
+            "policy": "All systems must run approved anti-malware software.",
+        },
+    ]
+    with patch.dict(policy_store_server.policy_data, {"policies": policies}):
+        result = policy_store_server.search_policies(["least privilege"])
+    assert [p["name"] for p in result["matching_policies"]] == ["Access Control Standard"]
+
+
+def test_shipped_policy_store_body_is_searchable():
+    """The shipped policy store keeps its main text under `policy`."""
+    result = policy_store_server.search_policies(["least privilege"])
+    assert result["total_matches"] > 0