class_docstr: Tests for ThreatIntel
class_docstr_tok: ["Tests","for","ThreatIntel"]
code: def _sample_payload(self):
      return {
          "record": {
              "account": 12345,
              "region": "us-east-1",
              "detail": {
                  "eventName": "ConsoleLogin",
                  "userIdentity": {
                      "userName": "alice",
                      "accountId": "12345",
                  },
                  "sourceIPAddress": "1.1.1.2",
                  "recipientAccountId": "12345",
              },
              "source": "1.1.1.2",
              "streamalert_normalization": {
                  "sourceAddress": {"1.1.1.2"},
                  "userName": {"alice"},
              },
          }
      }
  
imports: from botocore.exceptions import ClientError, ParamValidationError
  from mock import Mock, patch
  from netaddr import IPNetwork
  from nose.tools import assert_equal
  from streamalert.rules_engine.threat_intel import ThreatIntel
label_desc: Use image node_id 4 for calling the TestThreatIntel obj's underlying member method code with example usage: obj._sample_payload() and returns: dict