MicrosoftSentinelConvertEntitiesToTable

def test_format_entity():
    """
    Given:
        - An entity
    When:
         - calling format_entity function
    Then:
        - Validate the entity is formatted correctly
    """
    entity = {"name": "test", "kind": "test_kind", "type": "test_type", "properties": {"testProp": "test_value"}}
    expected = {"name": "test", "kind": "test_kind", "testProp": "test_value"}

    from MicrosoftSentinelConvertEntitiesToTable import format_entity

    result = format_entity(entity)

    assert result == expected


CONTEXT_RESULTS = (
    '[{"name": "test", "kind": "test_kind", "properties": {"testProp": "test_value", "isDomainJoined": true}},'
    '{"name": "test2", "kind": "test_kind2", "properties": {"testProp": "test_value2", "testProp2": "test_value3",'
    '"isDomainJoined": false}}]'
)

EXPECTED_TABLE = (
    "|Name|Kind|Test Prop|Is Domain Joined|Test Prop 2|\n"
    "|---|---|---|---|---|\n"
    "| test | test_kind | test_value | true |  |\n"
    "| test2 | test_kind2 | test_value2 | false | test_value3 |\n"
)


def test_convert_to_table():
    """
    Given:
        - A list of entities in string format
    When:
        - calling convert_to_table function
    Then:
        - Validate the table is created correctly
    """
    from MicrosoftSentinelConvertEntitiesToTable import convert_to_table

    result = convert_to_table(CONTEXT_RESULTS)

    assert result.readable_output == EXPECTED_TABLE