class_docstr: Tests for ThreatIntel
class_docstr_tok: ["Tests","for","ThreatIntel"]
docstr: ThreatIntel - Query, ClientError
docstr_tok: ["ThreatIntel","-","Query",",","ClientError"]
code: def test_query_client_error(self):
      """ThreatIntel - Query, ClientError"""
      query_values = {"1.1.1.1"}
      self._threat_intel._dynamodb.batch_get_item.side_effect = [
          # Raise a ClientError on first call
          ClientError({"Error": {"Code": 10}}, "BadRequest"),
          {
              "UnprocessedKeys": {},
              "Responses": {
                  "table_name": [
                      {
                          "ioc_value": {
                              "S": "1.1.1.1",
                          },
                          "sub_type": {"S": "mal_ip"},
                      }
                  ]
              },
          },
      ]
  
      expected_result = [{"ioc_value": "1.1.1.1", "sub_type": "mal_ip"}]
  
      result = self._threat_intel._query(query_values)
      assert_equal(
          self._threat_intel._dynamodb.batch_get_item.call_count, 2
      )
  
      assert_equal(result, expected_result)
  
imports: from botocore.exceptions import ClientError, ParamValidationError
  from mock import Mock, patch
  from netaddr import IPNetwork
  from nose.tools import assert_equal
  from streamalert.rules_engine.threat_intel import ThreatIntel
label_desc: Use image node_id 14 for calling the TestThreatIntel obj's underlying member method code with example usage: obj.test_query_client_error() without return types