class_docstr: Load threat intelligence data from DynamoDB and perform IOC detection
class_docstr_tok: ["Load","threat","intelligence","data","from","DynamoDB","and","perform","IOC","detection"]
docstr: Insert ioc info to a record
  
  Record is modified/updated in-place with IOC info inserted.
  
  Example:
      A new field of 'streamalert:ioc' will be added to the record:
  
      {
          'key': 'value',
          'sourceAddress': '4.3.2.1',
          'sourceDomain': 'evil1.com',
          'streamalert:ioc': {
              'ip': {'4.3.2.1'},
              'domain' : {'evil1.com'}
          }
      }
  
  Args:
      rec (dict): Record data
      ioc_type (str): IOC type, can be 'ip', 'domain', or 'md5'
      ioc_value (str): Malicious IOC value
docstr_tok: ["Insert","ioc","info","to","a","record","Record","is","modified\/updated","in-place","with","IOC","info","inserted",".","Example",":","A","new","field","of","'streamalert",":","ioc","'","will","be","added","to","the","record",":","{","'key","'",":","'value","'",",","'sourceAddress","'",":","'","4.3.2.1","'",",","'sourceDomain","'",":","'evil1.com","'",",","'streamalert",":","ioc","'",":","{","'ip","'",":","{","'","4.3.2.1","'","}",",","'domain","'",":","{","'evil1.com","'","}","}","}","Args",":","rec","(","dict",")",":","Record","data","ioc_type","(","str",")",":","IOC","type",",","can","be","'ip","'",",","'domain","'",",","or","'md5'","ioc_value","(","str",")",":","Malicious","IOC","value"]
code: def _insert_ioc_info(cls, rec, ioc_type, ioc_value):
      """Insert ioc info to a record
  
      Record is modified/updated in-place with IOC info inserted.
  
      Example:
          A new field of 'streamalert:ioc' will be added to the record:
  
          {
              'key': 'value',
              'sourceAddress': '4.3.2.1',
              'sourceDomain': 'evil1.com',
              'streamalert:ioc': {
                  'ip': {'4.3.2.1'},
                  'domain' : {'evil1.com'}
              }
          }
  
      Args:
          rec (dict): Record data
          ioc_type (str): IOC type, can be 'ip', 'domain', or 'md5'
          ioc_value (str): Malicious IOC value
      """
      # Get the current collection of IOCs, or create a new empty dictionary
      record_iocs = rec.get(cls.IOC_KEY, defaultdict(set))
      record_iocs[ioc_type].add(ioc_value)
      rec[cls.IOC_KEY] = record_iocs
  
imports: from collections import defaultdict
  from os import environ
  import backoff
  import boto3
  from boto3.dynamodb.types import TypeDeserializer
  from botocore.exceptions import ClientError, ParamValidationError
  from netaddr import IPNetwork
  from streamalert.shared.backoff_handlers import backoff_handler, success_handler, giveup_handler
  from streamalert.shared.logger import get_logger
  from streamalert.shared.normalize import Normalizer
  from streamalert.shared.utils import in_network, valid_ip
label_desc: Use image node_id 5 for calling the ThreatIntel obj's underlying member method code with example usage: obj._insert_ioc_info(cls, rec, ioc_type, ioc_value) without return types