class_docstr: Normalizer tests
class_docstr_tok: ["Normalizer","tests"]
docstr: Normalizer - Test normalization when condition applied
docstr_tok: ["Normalizer","-","Test","normalization","when","condition","applied"]
code: def test_normalize_condition(self):
      """Normalizer - Test normalization when condition applied"""
      log_type = "cloudtrail"
  
      region = NormalizedType(
          "test_log_type",
          "region",
          [
              {"path": ["region"], "function": "AWS region"},
              {
                  "path": ["detail", "awsRegion"],
                  "function": "AWS region",
                  "condition": {
                      "path": ["detail", "userIdentity", "userName"],
                      "not_in": ["alice", "bob"],
                  },
              },
          ],
      )
  
      ipv4 = NormalizedType(
          "test_log_type",
          "ip_address",
          [
              {
                  "path": ["sourceIPAddress"],
                  "function": "source ip address",
                  "condition": {"path": ["account"], "is": "123456"},
              },
              {
                  "path": ["detail", "source"],
                  "function": "source ip address",
                  "condition": {
                      "path": ["account"],
                      "is_not": "123456",
                  },
              },
          ],
      )
  
      Normalizer._types_config = {
          log_type: {"region": region, "ipv4": ipv4}
      }
      record = self._test_record()
      Normalizer.normalize(record, log_type)
  
      expected_record = {
          "account": 123456,
          "region": "region_name",
          "detail": {
              "awsRegion": "region_name",
              "source": "1.1.1.2",
              "userIdentity": {
                  "userName": "Alice",
                  "invokedBy": "signin.amazonaws.com",
              },
          },
          "sourceIPAddress": "1.1.1.3",
          "streamalert_normalization": {
              "streamalert_record_id": MOCK_RECORD_ID,
              "region": [
                  {"values": ["region_name"], "function": "AWS region"}
              ],
              "ipv4": [
                  {
                      "values": ["1.1.1.3"],
                      "function": "source ip address",
                  }
              ],
          },
      }
      assert_equal(record, expected_record)
  
imports: from mock import Mock, patch
  from nose.tools import assert_equal, assert_false, assert_raises, assert_true
  from streamalert.shared.exceptions import ConfigError
  from streamalert.shared.normalize import Normalizer, NormalizedType
  from tests.unit.streamalert.shared.test_utils import MOCK_RECORD_ID
label_desc: Use image node_id 23 for calling the TestNormalizer obj's underlying member method code with example usage: obj.test_normalize_condition() without return types