class_docstr: Load threat intelligence data from DynamoDB and perform IOC detection
class_docstr_tok: ["Load","threat","intelligence","data","from","DynamoDB","and","perform","IOC","detection"]
docstr: Instance method to extract IOC info from the record based on normalized keys
  
  Args:
    payloads (list<dict>): A list of dictionary payloads with records containing
      normalized data
  
  Returns:
    dict: Map of ioc values to the source record and type of ioc
docstr_tok: ["Instance","method","to","extract","IOC","info","from","the","record","based","on","normalized","keys","Args",":","payloads","(","list","<","dict",">",")",":","A","list","of","dictionary","payloads","with","records","containing","normalized","data","Returns",":","dict",":","Map","of","ioc","values","to","the","source","record","and","type","of","ioc"]
code: def _extract_ioc_values(self, payloads):
      """Instance method to extract IOC info from the record based on normalized keys
  
      Args:
        payloads (list<dict>): A list of dictionary payloads with records containing
          normalized data
  
      Returns:
        dict: Map of ioc values to the source record and type of ioc
      """
      ioc_values = defaultdict(list)
      for payload in payloads:
          record = payload["record"]
          if Normalizer.NORMALIZATION_KEY not in record:
              continue
          normalized_values = record[Normalizer.NORMALIZATION_KEY]
          for normalized_key, values in normalized_values.items():
              # Look up mapped IOC type based on normalized CEF type
              ioc_type = self._ioc_config.get(normalized_key)
              if not ioc_type:
                  LOGGER.debug(
                      "Skipping undefined IOC type for normalized key: %s",
                      normalized_key,
                  )
                  continue
  
              for value in values:
                  # Skip excluded IOCs
                  if self._is_excluded_ioc(ioc_type, value):
                      continue
  
                  ioc_values[value].append((ioc_type, record))
  
      return ioc_values
  
imports: from collections import defaultdict
  from os import environ
  import backoff
  import boto3
  from boto3.dynamodb.types import TypeDeserializer
  from botocore.exceptions import ClientError, ParamValidationError
  from netaddr import IPNetwork
  from streamalert.shared.backoff_handlers import backoff_handler, success_handler, giveup_handler
  from streamalert.shared.logger import get_logger
  from streamalert.shared.normalize import Normalizer
  from streamalert.shared.utils import in_network, valid_ip
label_desc: Use image node_id 12 for calling the ThreatIntel obj's underlying member method code with example usage: obj._extract_ioc_values(payloads) and returns: ioc_values