class_docstr: Load threat intelligence data from DynamoDB and perform IOC detection
class_docstr_tok: ["Load","threat","intelligence","data","from","DynamoDB","and","perform","IOC","detection"]
code: def _setup_excluded_iocs(excluded):
      if not excluded:
          return None
  
      excluded = {itype: set(iocs) for itype, iocs in excluded.items()}
  
      # Try to load IP addresses
      if "ip" in excluded:
          excluded["ip"] = {IPNetwork(ip) for ip in excluded["ip"]}
  
      return excluded
  
imports: from collections import defaultdict
  from os import environ
  import backoff
  import boto3
  from boto3.dynamodb.types import TypeDeserializer
  from botocore.exceptions import ClientError, ParamValidationError
  from netaddr import IPNetwork
  from streamalert.shared.backoff_handlers import backoff_handler, success_handler, giveup_handler
  from streamalert.shared.logger import get_logger
  from streamalert.shared.normalize import Normalizer
  from streamalert.shared.utils import in_network, valid_ip
label_desc: Use image node_id 13 for calling the ThreatIntel obj's underlying member method code with example usage: obj._setup_excluded_iocs(excluded) and returns: excluded, None