class_docstr: Load threat intelligence data from DynamoDB and perform IOC detection
class_docstr_tok: ["Load","threat","intelligence","data","from","DynamoDB","and","perform","IOC","detection"]
docstr: Public instance method to run threat intelligence against normalized records
  
  The records will be modified in-place by inserting IOC information if the
  records contain malicious IOC(s).
  
  Args:
      records (list): A list of payload instance with normalized records.
  
  Returns:
      list: A list of payload instances including IOC information.
docstr_tok: ["Public","instance","method","to","run","threat","intelligence","against","normalized","records","The","records","will","be","modified","in-place","by","inserting","IOC","information","if","the","records","contain","malicious","IOC","(","s",")",".","Args",":","records","(","list",")",":","A","list","of","payload","instance","with","normalized","records",".","Returns",":","list",":","A","list","of","payload","instances","including","IOC","information","."]
code: def threat_detection(self, records):
      """Public instance method to run threat intelligence against normalized records
  
      The records will be modified in-place by inserting IOC information if the
      records contain malicious IOC(s).
  
      Args:
          records (list): A list of payload instance with normalized records.
  
      Returns:
          list: A list of payload instances including IOC information.
      """
      if not records:
          return
  
      # Extract information from the records for IOC detection
      potential_iocs = self._extract_ioc_values(records)
  
      if not potential_iocs:
          LOGGER.debug("No IOCs extracted from records for processing")
          return
  
      # Query DynamoDB IOC type to verify if the extracted info are malicious IOC(s)
      for valid_ioc in self._process_ioc_values(list(potential_iocs)):
          value = valid_ioc["ioc_value"]
          for ioc_type, record in potential_iocs[value]:
              # Inserted the IOC info into the record
              self._insert_ioc_info(record, ioc_type, value)
  
imports: from collections import defaultdict
  from os import environ
  import backoff
  import boto3
  from boto3.dynamodb.types import TypeDeserializer
  from botocore.exceptions import ClientError, ParamValidationError
  from netaddr import IPNetwork
  from streamalert.shared.backoff_handlers import backoff_handler, success_handler, giveup_handler
  from streamalert.shared.logger import get_logger
  from streamalert.shared.normalize import Normalizer
  from streamalert.shared.utils import in_network, valid_ip
label_desc: Use image node_id 4 for calling the ThreatIntel obj's underlying member method code with example usage: obj.threat_detection(records) without return types