class_docstr: Tests for ThreatIntel
class_docstr_tok: ["Tests","for","ThreatIntel"]
docstr: ThreatIntel - Setup Excluded IOCs, With IPs
docstr_tok: ["ThreatIntel","-","Setup","Excluded","IOCs",",","With","IPs"]
code: def test_setup_excluded_iocs_ip(self):
      """ThreatIntel - Setup Excluded IOCs, With IPs"""
      excluded_iocs = {
          "ip": {"10.0.0.0/8": {"comment": "RFC1918"}},
          "md5": {
              "feca1deadbeefcafebeadbeefcafebee": {
                  "comment": "not malicious"
              }
          },
      }
      expected_result = {
          "ip": {IPNetwork("10.0.0.0/8")},
          "md5": {"feca1deadbeefcafebeadbeefcafebee"},
      }
      result = ThreatIntel._setup_excluded_iocs(excluded_iocs)
      assert_equal(result, expected_result)
  
imports: from botocore.exceptions import ClientError, ParamValidationError
  from mock import Mock, patch
  from netaddr import IPNetwork
  from nose.tools import assert_equal
  from streamalert.rules_engine.threat_intel import ThreatIntel
label_desc: Use image node_id 23 for calling the TestThreatIntel obj's underlying member method code with example usage: obj.test_setup_excluded_iocs_ip() without return types