class_docstr: Load threat intelligence data from DynamoDB and perform IOC detection
class_docstr_tok: ["Load","threat","intelligence","data","from","DynamoDB","and","perform","IOC","detection"]
docstr: Determine if we should bypass IOC lookup for specified IOC
  
  Args:
      ioc_type (string): Type of IOC to evaluate (md5, ip, domain, etc)
      value (string): Value of IOC to evaluate
  
  Returns:
      bool: True if IOC lookup should be bypassed for this value, False otherwise
docstr_tok: ["Determine","if","we","should","bypass","IOC","lookup","for","specified","IOC","Args",":","ioc_type","(","string",")",":","Type","of","IOC","to","evaluate","(","md5",",","ip",",","domain",",","etc",")","value","(","string",")",":","Value","of","IOC","to","evaluate","Returns",":","bool",":","True","if","IOC","lookup","should","be","bypassed","for","this","value",",","False","otherwise"]
code: def _is_excluded_ioc(self, ioc_type, ioc_value):
      """Determine if we should bypass IOC lookup for specified IOC
  
      Args:
          ioc_type (string): Type of IOC to evaluate (md5, ip, domain, etc)
          value (string): Value of IOC to evaluate
  
      Returns:
          bool: True if IOC lookup should be bypassed for this value, False otherwise
      """
      if not (self._excluded_iocs and ioc_type in self._excluded_iocs):
          return False
  
      exclusions = self._excluded_iocs[ioc_type]
  
      if ioc_type == "ip":
          # filter out *.amazonaws.com "IP"s
          return not valid_ip(ioc_value) or in_network(
              ioc_value, exclusions
          )
  
      return ioc_value in exclusions
  
imports: from collections import defaultdict
  from os import environ
  import backoff
  import boto3
  from boto3.dynamodb.types import TypeDeserializer
  from botocore.exceptions import ClientError, ParamValidationError
  from netaddr import IPNetwork
  from streamalert.shared.backoff_handlers import backoff_handler, success_handler, giveup_handler
  from streamalert.shared.logger import get_logger
  from streamalert.shared.normalize import Normalizer
  from streamalert.shared.utils import in_network, valid_ip
label_desc: Use image node_id 11 for calling the ThreatIntel obj's underlying member method code with example usage: obj._is_excluded_ioc(ioc_type, ioc_value) and returns: unknown, False, unknown