使用 Python 解析嵌套的 json 数据

Question

[
    {
        "asset_id": 49,
        "status": "success",
        "name": "de1",
        "app": "CCid",
        "action_results": [
            {
                "status": "success",
                "data": [
                    {
                        "report": {
                            "status": {
                                "origin": "sa",
                                "status": "Up.",
                                "sha1": "4a",
                                "sample_started_at": 159,
                                "running_on": "mt",
                                "ran": true,
                                "auto": true,
                                "vm": "w"
                            },
                            "artifacts": {
                                "1": {
                                    "size": 599518,
                                    "mime-type": "applic=binary",
                                    "antivirus": {
                                        "reversing_labs": {
                                            "status": "UNKNOWN",
                                            "scanner_count": 0,
                                            "scanner_match": 0,
                                            "threat_name": "",
                                            "query_hash": {
                                                "sha256": "029"
                                            },
                                            "last_seen": "0001-01-01T00:00:00Z"
                                        }
                                    },
                                    "entropy": 7.9870740440306
                                },
                                "10": {
                                    "size": 599518,
                                    "mime-type": "applic=binary",
                                    "antivirus": {
                                        "reversing_labs": {
                                            "status": "UNKNOWN",
                                            "scanner_count": 0,
                                            "scanner_match": 0,
                                            "threat_name": "",
                                            "query_hash": {
                                                "sha256": "d38"
                                            },
                                            "last_seen": "0001-01-01T00:00:00Z"
                                        }
                                    },
                                    "entropy": 1
                                }
                            }
                        }
                    }
                ],
                "app_id": 15
            }
        ]
    }
]            
             

I am trying to access scanner count and scanner match values using python But not getting the required result.

action_results = results[0].get('action_results', [])
action_status = action_results[0].get('status', 'failed') 
results_data = action_results[0].get('data', []) 
sandbox_report = results_data[0].get('report', {})
for key,value in sandbox_report.items():
            if key == "artifacts":
                artifacts = list()
                for each_key, each_value in value.items():
                    for i in each_value:
                        if i == "antivirus":
                            artifact_item = dict()
                            reversing_labs = i.get('reversing_labs', {})
                            artifact_item['scanner_count'] = reversing_labs.get('scanner_count', 0)

Can anyone point out whats wrong?

Answer 1

You can try

action_results = results[0].get('action_results', [])
action_status = action_results[0].get('status', 'failed')
results_data = action_results[0].get('data', [])
sandbox_report = results_data[0].get('report', {})
artifact_item = dict()
for key,value in sandbox_report.items():
            if key == "artifacts":
                artifacts = list()
                for each_key, each_value in value.items():
                    for k, v in each_value.items():
                        if k == "antivirus":
                            reversing_labs = v.get('reversing_labs', {})
                            artifact_item[key] = [{'scanner_count' : reversing_labs.get('scanner_count', 0)},
                                                    {'scanner_match' : reversing_labs.get('scanner_match', 0)}]
print(artifact_item)

Output

{'artifacts': [{'scanner_count': 0}, {'scanner_match': 0}]}

This code will extract the values of scanner_count and scanner_match in a list in a dictionary that the key value is artifacts.

Answer 2

this is how i'd do it.

jsonData = json.loads(results)
nested = jsonData[0]['action_results'][0]['data'][0]['report']['artifacts']

for artifact in nested:
    print(f"Scanner count = {nested[artifact]['antivirus']['reversing_labs']['scanner_count']}")
    print(f"Scanner match = {nested[artifact]['antivirus']['reversing_labs']['scanner_match']}")