Add entity JSON object to Slack Privilege Escalation tests

[bmbeverst]

Background

Noticed that the move from JSON to YAML had caused the addition of the entity block to be missed. The tests therefore show unknown-actor and unknown-email. This does not impact the functionality issue but could lead to confusion.

Slack.AuditLogs.UserPrivilegeEscalation
	[PASS] Permissions Assigned
		[PASS] [rule] true
		[PASS] [title] Slack User Assigned Permissions <unknown-actor> (<unknown-email>)
		[PASS] [dedup] Slack User Assigned Permissions <unknown-actor> (<unknown-email>)
		[PASS] [alertContext] {"actor-name": "username", "actor-email": "user@example.com", "actor-ip": "1.2.3.4", "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"}
		[PASS] [severity] MEDIUM

	[PASS] Role Changed to Admin
		[PASS] [rule] true
		[PASS] [title] Slack User Made Admin <unknown-actor> (<unknown-email>)
		[PASS] [dedup] Slack User Made Admin <unknown-actor> (<unknown-email>)
		[PASS] [alertContext] {"actor-name": "username", "actor-email": "user@example.com", "actor-ip": "1.2.3.4", "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"}
		[PASS] [severity] CRITICAL

	[PASS] Role Changed to Owner
		[PASS] [rule] true
		[PASS] [title] Slack User Made Owner <unknown-actor> (<unknown-email>)
		[PASS] [dedup] Slack User Made Owner <unknown-actor> (<unknown-email>)
		[PASS] [alertContext] {"actor-name": "username", "actor-email": "user@example.com", "actor-ip": "1.2.3.4", "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"}
		[PASS] [severity] CRITICALunrestricted

Changes

• Added the entity block in test JSON.

Testing

• pipenv run panther_analysis_tool test --skip-disabled-tests --sort-test-results

Slack.AuditLogs.UserPrivilegeEscalation
	[PASS] Permissions Assigned
		[PASS] [rule] true
		[PASS] [title] Slack User Assigned Permissions primary-owner (user@example.com)
		[PASS] [dedup] Slack User Assigned Permissions primary-owner (user@example.com)
		[PASS] [alertContext] {"actor-name": "username", "actor-email": "user@example.com", "actor-ip": "1.2.3.4", "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"}
		[PASS] [severity] MEDIUM

	[PASS] Role Changed to Admin
		[PASS] [rule] true
		[PASS] [title] Slack User Made Admin primary-owner (user@example.com)
		[PASS] [dedup] Slack User Made Admin primary-owner (user@example.com)
		[PASS] [alertContext] {"actor-name": "username", "actor-email": "user@example.com", "actor-ip": "1.2.3.4", "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"}
		[PASS] [severity] CRITICAL

	[PASS] Role Changed to Owner
		[PASS] [rule] true
		[PASS] [title] Slack User Made Owner primary-owner (user@example.com)
		[PASS] [dedup] Slack User Made Owner primary-owner (user@example.com)
		[PASS] [alertContext] {"actor-name": "username", "actor-email": "user@example.com", "actor-ip": "1.2.3.4", "user-agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36"}
		[PASS] [severity] CRITICAL

[ben-githubs]

Nice catch, thanks for fixing this!