class_docstr: Tests for ThreatIntel
class_docstr_tok: ["Tests","for","ThreatIntel"]
docstr: ThreatIntel - Threat Detection
docstr_tok: ["ThreatIntel","-","Threat","Detection"]
code: def test_threat_detection(self):
      """ThreatIntel - Threat Detection"""
      payloads = [self._sample_payload]
  
      expected_result = {
          "account": 12345,
          "region": "us-east-1",
          "detail": {
              "eventName": "ConsoleLogin",
              "userIdentity": {
                  "userName": "alice",
                  "accountId": "12345",
              },
              "sourceIPAddress": "1.1.1.2",
              "recipientAccountId": "12345",
          },
          "source": "1.1.1.2",
          "streamalert_normalization": {
              "sourceAddress": {"1.1.1.2"},
              "userName": {"alice"},
          },
          "streamalert:ioc": {"ip": {"1.1.1.2"}},
      }
  
      with patch.object(
          self._threat_intel, "_process_ioc_values"
      ) as process_mock:
          process_mock.return_value = [
              {"ioc_value": "1.1.1.2", "sub_type": "mal_ip"}
          ]
          self._threat_intel.threat_detection(payloads)
          assert_equal(payloads[0]["record"], expected_result)
  
imports: from botocore.exceptions import ClientError, ParamValidationError
  from mock import Mock, patch
  from netaddr import IPNetwork
  from nose.tools import assert_equal
  from streamalert.rules_engine.threat_intel import ThreatIntel
label_desc: Use image node_id 6 for calling the TestThreatIntel obj's underlying member method code with example usage: obj.test_threat_detection() without return types