azure_log_analytics: fix translation of IN operator

stix_shifter_modules/azure_log_analytics/stix_translation/query_constructor.py

@@ -171,15 +171,8 @@ def format_comparision_string(comparison_string, mapped_field, lambda_func):
             # for In operator, loop the format comparision string for each values in the list.
             if expression.comparator == ComparisonComparators.In:
                 if isinstance(values, list):
-                    values_count = len(values)
-                    for value in values:
-                        comparison_string = format_comparision_string(comparison_string, mapped_field, lambda_func)
-                        if values_count > 1:
-                            if expression.negated:
-                                comparison_string += " and "
-                            else:
-                                comparison_string += " or "
-                            values_count -= 1
+                    comparison_string += "{mapped_field} in ({value})".format(
+                        mapped_field=mapped_field, value=', '.join(value))
             # to form queries other than IN operator
             else:
                 comparison_string = format_comparision_string(comparison_string, mapped_field, lambda_func)

stix_shifter_modules/azure_log_analytics/tests/stix_translation/test_azure_sentinel_log_analytics_stix_to_query.py

@@ -181,3 +181,17 @@ def test_user_account_query(self):
 
         queries = _remove_timestamp_from_query(queries)
         self._test_query_assertions(query, queries)
+
+    def test_in_operator(self):
+        stix_pattern = ("[process:name = 'rclone.exe' AND"
+                        " process:parent_ref.name IN ('pwsh.exe','powershell.exe', 'cmd.exe')]"
+                        " START t'2023-02-14T19:43:08.674Z' STOP t'2023-02-28T19:43:08.674Z'")
+        query = translation.translate(MODULE, 'query', '{}', stix_pattern)
+        query['queries'] = _remove_timestamp_from_query(query['queries'])
+
+        queries = ["SecurityEvent | where (ParentProcessName in ('pwsh.exe', 'powershell.exe', 'cmd.exe') and "
+                   "(ProcessName == 'rclone.exe' or LogonProcessName == 'rclone.exe')) and "
+                   "(TimeGenerated between (datetime(2023-02-14T19:43:08.674Z) .. datetime(2023-02-28T19:43:08.674Z)))"]
+
+        queries = _remove_timestamp_from_query(queries)
+        self._test_query_assertions(query, queries)