class_docstr: Tests for ThreatIntel
class_docstr_tok: ["Tests","for","ThreatIntel"]
code: def _default_config(self):
      return {
          "threat_intel": {
              "dynamodb_table_name": "table_name",
              "enabled": True,
              "excluded_iocs": {
                  "domain": {
                      "not.evil.com": {"comment": "not an evil domain"}
                  }
              },
              "normalized_ioc_types": {
                  "domain": ["destinationDomain"],
                  "ip": ["sourceAddress", "destinationAddress"],
                  "md5": ["fileHash"],
              },
          },
          "clusters": {"prod": {"enable_threat_intel": True}},
      }
  
imports: from botocore.exceptions import ClientError, ParamValidationError
  from mock import Mock, patch
  from netaddr import IPNetwork
  from nose.tools import assert_equal
  from streamalert.rules_engine.threat_intel import ThreatIntel
label_desc: Use image node_id 3 for calling the TestThreatIntel obj's underlying member method code with example usage: obj._default_config() and returns: dict