diff --git a/packages/ti_anomali/data_stream/threatstream/_dev/test/policy/test-all.expected b/packages/ti_anomali/data_stream/threatstream/_dev/test/policy/test-all.expected
index c3d0fab9298..3a048698713 100644
--- a/packages/ti_anomali/data_stream/threatstream/_dev/test/policy/test-all.expected
+++ b/packages/ti_anomali/data_stream/threatstream/_dev/test/policy/test-all.expected
@@ -37,7 +37,8 @@ inputs:
             certificate: /etc/pki/client/cert.pem
             enabled: false
             key: /etc/pki/client/cert.key
-          tags: null
+          tags:
+            - custom-ti_anomali
           type: http_endpoint
           url: /
       type: http_endpoint
diff --git a/packages/ti_anomali/data_stream/threatstream/_dev/test/policy/test-all.yml b/packages/ti_anomali/data_stream/threatstream/_dev/test/policy/test-all.yml
index 832f1329fd4..400c887fc22 100644
--- a/packages/ti_anomali/data_stream/threatstream/_dev/test/policy/test-all.yml
+++ b/packages/ti_anomali/data_stream/threatstream/_dev/test/policy/test-all.yml
@@ -11,6 +11,7 @@ data_stream:
       key: "/etc/pki/client/cert.key"
     ioc_expiration_duration: "90d"
     tags:
+      - custom-ti_anomali
     preserve_original_event: false
     processors: |
       - add_fields: