class_docstr: Simple class to encapsulate the mocked threat intel results
docstr: Return the function to mock out ThreatIntel._query
  
  This simply returns values from the log that are in the mock_ioc_values
  based on fixtures that match the provided rule_path
docstr_tok: ["Return","the","function","to","mock","out","ThreatIntel._query","This","simply","returns","values","from","the","log","that","are","in","the","mock_ioc_values","based","on","fixtures","that","match","the","provided","rule_path"]
code: def get_mock_values(cls, values):
      """Return the function to mock out ThreatIntel._query
  
      This simply returns values from the log that are in the mock_ioc_values
      based on fixtures that match the provided rule_path
      """
      return [cls._MOCKS[item] for item in cls._MOCKS if item in values]
  
file_path: streamalert/streamalert_cli/test/mocks.py
imports: from streamalert.shared.logger import get_logger
  from streamalert.shared.lookup_tables.drivers import EphemeralDriver
  from streamalert.shared.lookup_tables.table import LookupTable
label_desc: Use image node_id 2 for calling the ThreatIntelMocks obj's underlying member method code with example usage: obj.get_mock_values(cls, values) and returns: unknown