解析嵌套字典时出错：平台和sha256

Question

提取classification和query hash值时获取平台和sha256密钥错误。有人能确定我做错了什么吗？我能够提取除这两个值之外的其他值

我是这样做的：

artifact_item=dict()
artifact_item['classification']=artifacts.get('classification',{})
artifact_item['query_hash']=artifacts.get('query_hash',{})

工件：

artifacts={{
    "status": "SUSPICIOUS",
    "scanner_count": 48,
    "classification": {
        "platform": "Win32",
        "type": "Malware",
        "family_name": "Xls"
    },
    "scanner_match": 4,
    "threat_name": "Win32.Malware.Xls",
    "query_hash": {
        "sha256": "de5aae888888888c81bf2b6be27a3e68ef8db4bbeb378a9fff36601d112d435f"
    }
    
},
{
    "status": "UNKNOWN",
    "scanner_count": 0,
    "classification": {},
    "scanner_match": 0,
    "threat_name": "",
    "query_hash": {
        "sha256": "2fa54155787a9f070b6ae93ea267fc759b3261fd00000ca166c5c30a1f1bae12"
    }
},
{
    "status": "UNKNOWN",
    "scanner_count": 0,
    "classification": {},
    "scanner_match": 0,
    "threat_name": "",
    "query_hash": {
        "sha256": "a9fcd0c850d5d77160d58e0000760bcef221279d0f78c0460fbbb4269cb8c4a5"
    }
},
{
    "status": "KNOWN",
    "scanner_count": 40,
    "classification": {},
    "scanner_match": 0,
    "threat_name": "",
    "query_hash": {
        "sha256": "e3b0c44298fc1c149afbf4c0000fb92427ae41e4649b934ca495991b7852b855"
    }
    
}}

Answer 1

在尝试复制您的错误之后，我注意到artifacts对象（据我所知是JSON数据对象？）的格式不正确， 为了解决这个问题，我获取了工件json数据，并给每个字典一个参数，如下所示：

{
    "Property1" : {
        "status": "SUSPICIOUS",
        "scanner_count": 48,
        "classification": {
            "platform": "Win32",
            "type": "Malware",
            "family_name": "Xls"
        },
        "scanner_match": 4,
        "threat_name": "Win32.Malware.Xls",
        "query_hash": {
            "sha256": "de5aae888888888c81bf2b6be27a3e68ef8db4bbeb378a9fff36601d112d435f"
        }
        
    },
    "Property2" :{
        "status": "UNKNOWN",
        "scanner_count": 0,
        "classification": {},
        "scanner_match": 0,
        "threat_name": "",
        "query_hash": {
            "sha256": "2fa54155787a9f070b6ae93ea267fc759b3261fd00000ca166c5c30a1f1bae12"
        }
    },
    "Property3" :{
        "status": "UNKNOWN",
        "scanner_count": 0,
        "classification": {},
        "scanner_match": 0,
        "threat_name": "",
        "query_hash": {
            "sha256": "a9fcd0c850d5d77160d58e0000760bcef221279d0f78c0460fbbb4269cb8c4a5"
        }
    },
    "Property4" :{
        "status": "KNOWN",
        "scanner_count": 40,
        "classification": {},
        "scanner_match": 0,
        "threat_name": "",
        "query_hash": {
            "sha256": "e3b0c44298fc1c149afbf4c0000fb92427ae41e4649b934ca495991b7852b855"
        }
        
    }
}

注意每个字典的"Property1"键值， 然后，通过在python中导入JSON库，我们可以加载和解析数据，并使用它获取数据：

编辑：

import json 
  
# Opening JSON file 
with open('data.json') as json_file: 
    data = json.load(json_file) 
  
    # Print the type of data variable 
    artifact_item = dict(data['Property1'])
    classification = artifact_item.get('classification',{})
    if classification == {}:
        print('Classification is empty')
    else:
        plat = classification['platform']

我们可以迭代JSON中的每个Property键值以获得所有数据， 当然，我们可以使用artifact_item.get('classification',{})来获得您想要的数据

编辑：我们可以通过以下操作实现相同的属性：

artifact_item2 = dict(data['Property1'])['classification']['platform']

请注意，我首先使用dict(data['Property1'])从JSON数据创建一个字典，然后像普通字典一样访问数据

我希望这有帮助