---
inputType: "CA10__CaAzureAccount__c"
importExtracts:
  - file: "/types/CA10__CaAzureAccount__c/object.extracts.yaml"
testData:
  - file: "test-data.json"
conditions:
      - status: "INCOMPLIANT"
        currentStateMessage: "Microsoft Defender for Endpoint is not enabled."
        remediationMessage: "Consider enabling Microsoft Defender for Endpoint."
        check:
          NOT:
            arg:
              JSON_QUERY_BOOLEAN:
                arg: 
                  EXTRACT: "caJsonFrom__defenderForCloudSettings__c"
                expression: "settings[?name == 'WDATP'].enabled | [0]"
                undeterminedIf: 
                  evaluationError: "The JSON query has failed."
                  resultTypeMismatch: "The JSON query did not return text type."
      - status: "COMPLIANT"
        currentStateMessage: "Microsoft Defender for Endpoint is enabled."
        check:
          JSON_QUERY_BOOLEAN:
            arg: 
              EXTRACT: "caJsonFrom__defenderForCloudSettings__c"
            expression: "settings[?name == 'WDATP'].enabled | [0]"
            undeterminedIf: 
              evaluationError: "The JSON query has failed."
              resultTypeMismatch: "The JSON query did not return text type."
otherwise:
  status: "UNDETERMINED"
  currentStateMessage: "Unexpected value in the field."