class_docstr: Load threat intelligence data from DynamoDB and perform IOC detection
class_docstr_tok: ["Load","threat","intelligence","data","from","DynamoDB","and","perform","IOC","detection"]
docstr: Public class constructor method to return instance of ThreatIntel class
  
  Args:
      config (dict): Config read from 'conf/' directory
  
  Returns:
      ThreatIntel: Class to be used for threat intelligence logic
docstr_tok: ["Public","class","constructor","method","to","return","instance","of","ThreatIntel","class","Args",":","config","(","dict",")",":","Config","read","from","'conf\/","'","directory","Returns",":","ThreatIntel",":","Class","to","be","used","for","threat","intelligence","logic"]
code: def load_from_config(cls, config):
      """Public class constructor method to return instance of ThreatIntel class
  
      Args:
          config (dict): Config read from 'conf/' directory
  
      Returns:
          ThreatIntel: Class to be used for threat intelligence logic
      """
      if "threat_intel" not in config:
          return
  
      intel_config = config["threat_intel"]
      if not intel_config.get("enabled"):
          return
  
      # Threat Intel can be disabled for any given cluster
      enabled_clusters = {
          cluster
          for cluster, values in config["clusters"].items()
          if values.get("enable_threat_intel", False)
      }
  
      if not enabled_clusters:
          return  # if not clusters have threat intel enabled, there's nothing to do
  
      # Convert the current IOC mapping to be in the format
      # {'normalized_key': 'ioc_type'} for simpler lookups
      ioc_config = {
          key: ioc_type
          for ioc_type, keys in intel_config[
              "normalized_ioc_types"
          ].items()
          for key in keys
      }
  
      return cls(
          table=intel_config["dynamodb_table_name"],
          enabled_clusters=enabled_clusters,
          ioc_types_map=ioc_config,
          excluded_iocs=intel_config.get("excluded_iocs"),
      )
  
imports: from collections import defaultdict
  from os import environ
  import backoff
  import boto3
  from boto3.dynamodb.types import TypeDeserializer
  from botocore.exceptions import ClientError, ParamValidationError
  from netaddr import IPNetwork
  from streamalert.shared.backoff_handlers import backoff_handler, success_handler, giveup_handler
  from streamalert.shared.logger import get_logger
  from streamalert.shared.normalize import Normalizer
  from streamalert.shared.utils import in_network, valid_ip
label_desc: Use image node_id 14 for calling the ThreatIntel obj's underlying member method code with example usage: obj.load_from_config(cls, config) and returns: cls