[trend_micro_vision_one] add policy tests

[brijesh-elastic]

Proposed commit message

trend_micro_vision_one: add policy tests

Note

No changelog entry required as no user-facing changes.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

How to test this PR locally

1. Clone integrations repo.
2. Install the elastic package locally.
3. Start the elastic stack using the elastic package.
4. Move to integrations/packages/trend_micro_vision_one directory.
5. Run the following command to run tests.
   elastic-package test policy --generate

--- Test results for package: trend_micro_vision_one - START ---
╭────────────────────────┬───────────────────┬───────────┬──────────────────┬────────┬───────────────╮
│ PACKAGE                │ DATA STREAM       │ TEST TYPE │ TEST NAME        │ RESULT │  TIME ELAPSED │
├────────────────────────┼───────────────────┼───────────┼──────────────────┼────────┼───────────────┤
│ trend_micro_vision_one │ alert             │ policy    │ test-all.yml     │ PASS   │  9.504993291s │
│ trend_micro_vision_one │ alert             │ policy    │ test-default.yml │ PASS   │   9.03458275s │
│ trend_micro_vision_one │ audit             │ policy    │ test-all.yml     │ PASS   │  9.043280875s │
│ trend_micro_vision_one │ audit             │ policy    │ test-default.yml │ PASS   │ 10.057154917s │
│ trend_micro_vision_one │ detection         │ policy    │ test-all.yml     │ PASS   │ 10.033734459s │
│ trend_micro_vision_one │ detection         │ policy    │ test-default.yml │ PASS   │ 10.049399417s │
│ trend_micro_vision_one │ endpoint_activity │ policy    │ test-all.yml     │ PASS   │  9.034070959s │
│ trend_micro_vision_one │ endpoint_activity │ policy    │ test-default.yml │ PASS   │  8.013490792s │
│ trend_micro_vision_one │ network_activity  │ policy    │ test-all.yml     │ PASS   │  8.017830375s │
│ trend_micro_vision_one │ network_activity  │ policy    │ test-default.yml │ PASS   │ 11.042730542s │
│ trend_micro_vision_one │ telemetry         │ policy    │ test-all.yml     │ PASS   │ 12.050106916s │
│ trend_micro_vision_one │ telemetry         │ policy    │ test-default.yml │ PASS   │ 11.052934625s │
╰────────────────────────┴───────────────────┴───────────┴──────────────────┴────────┴───────────────╯
--- Test results for package: trend_micro_vision_one - END   ---
Done

Related issues

• Closes trend_micro_vision_one: Add policy tests for integration quality checks #17223

[elasticmachine]

Pinging @elastic/security-service-integrations (Team:Security-Service Integrations)

[github-actions]

✅ Vale Linting Results

No issues found on modified lines!

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package trend_micro_vision_one 👍(3) 💚(1) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
audit	6993.01	5347.59	-1645.42 (-23.53%)	💔
endpoint_activity	4385.96	2832.86	-1553.1 (-35.41%)	💔

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 9fe9956

History

• 💔 Build #37937 failed 2529859

cc @brijesh-elastic

[brijesh-elastic]

Policy tests were failing in the telemetry data stream(2529859) because the generated expected policy used a literal block with an indentation indicator (program: |4). That happens in elastic-package during YAML marshalling when the program string has mixed indentation (e.g. comments at the start with little or no leading space). That emitted YAML can then fail to round-trip when we unmarshal the same file. the parser then expects every line in that block to have at least 4 leading spaces; our content didn’t, which triggered the error (generated by cursor)

2026/02/11 07:27:24 ERROR failed to compare policies: failed to prepare expected policy: failed to decode policy: yaml: line 8: did not find expected key

To avoid the failure, I wrapped the program body in parentheses(9fe9956) so the generated YAML no longer hits this case.