def In(field, values):
    """
    A criterion used to search for records where `field` has one of the `values`. For example

    * search for observables of type domain, fqdn, ip
    * search for cases tagged as malspam, or phising

    Arguments:
        field (str): field name
        values (Array): A set of values the field must be in

    Returns:
        dict: JSON repsentation of the criterion
            ```python
            # Query to search for observables of one of the following types: domain, fqdn, ip
            query = In('dataType', ['domain', 'fqdn', 'ip'])
            ```
            produces
            ```json
            {
                "_in": {
                    "_field": "dataType",
                    "_values": [
                        "domain",
                        "fqdn",
                        "ip"
                    ]
                }
            }
            ```
    """
    return {'_in': {'_field': field, '_values': values}}