Everywhere we do things like this: https://github.com/ThreatResponse/aws_ir/blob/044b4b9aa07e5517953e54371c9ba33e990d21ab/aws_ir/libs/volatile.py#L40 Extract into default config file so it can be modified.