Python 操作 json、列表和字典

Question

抱歉，篇幅较长，但我尽力做到完整。

我正在尝试获取以下数据 -(仅从更大的 json 文件中进行小样本采样，结构相同)

{
    "count": 394,
    "status": "ok",
    "data": [
        {
            "md5": "cd042ba78d0810d86755136609793d6d",
            "threatscore": 90,
            "threatlevel": 0,
            "avdetect": 0,
            "vxfamily": "",
            "domains": [
                "dynamicflakesdemo.com",
                "www.bountifulbreast.co.uk"
            ],
            "hosts": [
                "66.33.214.180",
                "64.130.23.5",
            ],
            "environmentId": "1",
        },
        {
            "md5": "4f3a560c8deba19c5efd48e9b6826adb",
            "threatscore": 65,
            "threatlevel": 0,
            "avdetect": 0,
            "vxfamily": "",
             "domains": [
                "px.adhigh.net"
            ],
            "hosts": [
                "130.211.155.133",
                "65.52.108.163",
                "172.225.246.16"
            ],
            "environmentId": "1",
        }
    ]
}

如果“threatscore”超过 70，我想将其添加到此 json 结构中 -前任。 “数据”: [ { "md5": "cd042ba78d0810d86755136609793d6d", “威胁分数”:90，

{
"Event":
    {"date":"2015-11-25",
    "threat_level_id":"1",
    "info":"HybridAnalysis",
    "analysis":"0",
    "distribution":"0",
    "orgc":"SOC", 
    "Attribute": [
        {"type":"ip-dst",
        "category":"Network activity",
        "to_ids":True,
        "distribution":"3",
        "value":"66.33.214.180"},
        {"type":"ip-dst",
        "category":"Network activity",
        "to_ids":True,
        "distribution":"3",
        "value":"64.130.23.5"}
        {"type":"domain",
        "category":"Network activity",
        "to_ids":True,
        "distribution":"3",
        "value":"dynamicflakesdemo.com"},
        {"type":"domain",
        "category":"Network activity",
        "to_ids":True,
        "distribution":"3",
        "value":"www.bountifulbreast.co.uk"}
        {"type":"md5",
        "category":"Payload delivery",
        "to_ids":True,
        "distribution":"3",
        "value":"cd042ba78d0810d86755136609793d6d"}]
}
}

这是我的代码 -

from datetime import datetime
import os
import json
from pprint import pprint

now = datetime.now()

testFile = open("feed.json")
feed = json.load(testFile)


for x in feed['data']:
    if x['threatscore'] > 90:
        data = {}
        data['Event']={}
        data['Event']["date"] = now.strftime("%Y-%m-%d")
        data['Event']["threat_level_id"] = "1"
        data['Event']["info"] = "HybridAnalysis"
        data['Event']["analysis"] = 0
        data['Event']["distribution"] = 3
        data['Event']["orgc"] = "Malware"
        data['Event']["Attribute"] = []
        if 'hosts' in x:
            data['Event']["Attribute"].append({'type': "ip-dst"})
            data['Event']["Attribute"][0]["category"] = "Network activity"
            data['Event']["Attribute"][0]["to-ids"] = True
            data['Event']["Attribute"][0]["distribution"] = "3"
            data["Event"]["Attribute"][0]["value"] =x['hosts'] 
        if 'md5' in x:
            data['Event']["Attribute"].append({'type': "md5"})
            data['Event']["Attribute"][1]["category"] = "Payload delivery"
            data['Event']["Attribute"][1]["to-ids"] = True
            data['Event']["Attribute"][1]["distribution"]  = "3"
            data['Event']["Attribute"][1]['value'] = x['md5']
        if 'domains' in x:
            data['Event']["Attribute"].append({'type': "domain"})
            data['Event']["Attribute"][2]["category"] = "Network activity"
            data['Event']["Attribute"][2]["to-ids"] = True
            data['Event']["Attribute"][2]["distribution"] = "3"
            data['Event']["Attribute"][2]["value"] = x['domains']
        attributes = data["Event"]["Attribute"]
        data["Event"]["Attribute"] = []
        for attribute in attributes:
            for value in attribute["value"]:
                    if value == " ":
                        pass
                    else:
                        new_attr = attribute.copy()
                        new_attr["value"] = value
                        data["Event"]["Attribute"].append(new_attr)
        pprint(data)

with open('output.txt', 'w') as outfile:
    json.dump(data, outfile)

现在它似乎被清理了一点，但数据['md5']正在每个字母上分割，我认为这就像L3viathan之前所说的那样，我不断覆盖字典中的第一个元素......但我不知道如何让它继续追加？？？

{'Event': {'Attribute': [{'category': 'Network activity',
                          'distribution': '3',
                          'to-ids': True,
                          'type': 'ip-dst',
                          'value': u'216.115.96.174'},
                         {'category': 'Network activity',
                          'distribution': '3',
                          'to-ids': True,
                          'type': 'ip-dst',
                          'value': u'64.4.54.167'},
                         {'category': 'Network activity',
                          'distribution': '3',
                          'to-ids': True,
                          'type': 'ip-dst',
                          'value': u'63.250.200.37'},
                         {'category': 'Payload delivery',
                          'distribution': '3',
                          'to-ids': True,
                          'type': 'md5',
                          'value': u'7'},
                         {'category': 'Payload delivery',
                          'distribution': '3',
                          'to-ids': True,
                          'type': 'md5',
                          'value': u'1'},

最后仍然出现以下错误:回溯(最近一次调用最后一次): 文件“hybridanalysis.py”，第 34 行，位于 data['Event']["Attribute"][1]["category"] = "有效负载传送"IndexError:列表索引超出范围

最终目标是对其进行设置，以便我可以将事件发布到 MISP 中，但它们必须一次发布一个。

Answer 1

我认为这应该可以解决您的问题。我一次性添加了属性字典，并将数据移动到列表中(这更合适)，但您可能想要删除包装事件的多余列表。

from datetime import datetime
import os
import json
from pprint import pprint

now = datetime.now()

testFile = open("feed.json")
feed = json.load(testFile)

data_list = []

for x in feed['data']:
    if x['threatscore'] > 90:
        data = {}
        data['Event']={}
        data['Event']["date"] = now.strftime("%Y-%m-%d")
        data['Event']["threat_level_id"] = "1"
        data['Event']["info"] = "HybridAnalysis"
        data['Event']["analysis"] = 0
        data['Event']["distribution"] = 3
        data['Event']["orgc"] = "Malware"
        data['Event']["Attribute"] = []
        if 'hosts' in x:
            data['Event']["Attribute"].append({
                'type': 'ip-dst',
                'category': 'Network activity',
                'to-ids': True,
                'distribution': '3',
                'value': x['hosts']})
        if 'md5' in x:
            data['Event']["Attribute"].append({
                'type': 'md5',
                'category': 'Payload delivery',
                'to-ids': True,
                'distribution': '3',
                'value': x['md5']})
        if 'domains' in x:
            data['Event']["Attribute"].append({
                'type': 'domain',
                'category': 'Network activity',
                'to-ids': True,
                'distribution': '3',
                'value': x['domains']})
        attributes = data["Event"]["Attribute"]
        data["Event"]["Attribute"] = []
        for attribute in attributes:
            for value in attribute["value"]:
                    if value == " ":
                        pass
                    else:
                        new_attr = attribute.copy()
                        new_attr["value"] = value
                        data["Event"]["Attribute"].append(new_attr)
        data_list.append(data)

with open('output.txt', 'w') as outfile:
    json.dump(data_list, outfile)