Py学习  »  Python

如何在python中浏览并仅获取json位置0[duplicate]

Sandson Costa • 3 年前 • 1342 次点击  

我有以下json输出。

"detections": [
  {
    "source": "detection",
    "uuid": "50594028",
    "detectionTime": "2022-03-27T06:50:56Z",
    "ingestionTime": "2022-03-27T07:04:50Z",
    "filters": [
      {
        "id": "F2058",
        "unique_id": "3638f7c0",
        "level": "critical",
        "name": "Possible Right-To-Left Override Attack",
        "description": "Possible Right-To-Left Override Detected in the Filename",
        "tactics": [
          "TA0005"
        ],
        "techniques": [
          "T1036.002"
        ],
        "highlightedObjects": [
          {
            "field": "fileName",
            "type": "filename",
            "value": [
              "1465940311.,S=473394(NONAMEFL(Z00057-PI‮fdp.exe))"
            ]
          },
          {
            "field": "filePathName",
            "type": "fullpath",
            "value": "/exports/10_19/mail/12/91/20193/new/1465940311.,S=473394(NONAMEFL(Z00057-PI‮fdp.exe))"
          },
          {
            "field": "malName",
            "type": "detection_name",
            "value": "HEUR_RLOTRICK.A"
          },
          {
            "field": "actResult",
            "type": "text",
            "value": [
              "Passed"
            ]
          },
          {
            "field": "scanType",
            "type": "text",
            "value": "REALTIME"
          }
        ]
      },
      {
        "id": "F2140",
        "unique_id": "5a313874",
        "level": "medium",
        "name": "Malicious Software",
        "description": "A malicious software was detected on an endpoint.",
        "tactics": [],
        "techniques": [],
        "highlightedObjects": [
          {
            "field": "fileName",
            "type": "filename",
            "value": [
              "1465940311.,S=473394(NONAMEFL(Z00057-PI‮fdp.exe))"
            ]
          },
          {
            "field": "filePathName",
            "type": "fullpath",
            "value": "/exports/10_19/mail/12/91/rs001291-excluido-20193/new/1465940311.,S=473394(NONAMEFL(Z00057-PI‮fdp.exe))"
          },
          {
            "field": "malName",
            "type": "detection_name",
            "value": "HEUR_RLOTRICK.A"
          },
          {
            "field": "actResult",
            "type": "text",
            "value": [
              "Passed"
            ]
          },
          {
            "field": "scanType",
            "type": "text",
            "value": "REALTIME"
          },
          {
            "field": "endpointIp",
            "type": "ip",
            "value": [
              "xxx.xxx.xxx"
            ]
          }
        ]
      }
    ],
    "entityType": "endpoint",
    "entityName": "xxx(xxx.xxx.xxx)",
    "endpoint": {
      "name": "xxx",
      "guid": "d1dd7e61",
      "ips": [
        "2xx.xxx.xxx"
      ]
    }
  }

在“filters”偏移量中,它给我带来了两个级别,一个是critical,一个是medim,都带有变量“name”。 我只想打印第一个名字,但当我打印“名字”时,它会返回两个名字: enter image description here

如何只打印第一张? 如果我把打印出来 filters ,它返回两个名称: enter image description here

如果我把打印出来 detections ,它只返回第二个“name”,这不是我想要的: enter image description here

Python社区是高质量的Python/Django开发社区
本文地址:http://www.python88.com/topic/130177
 
1342 次点击  
文章 [ 1 ]  |  最新文章 3 年前
enke
Reply   •   1 楼
enke    3 年前

如果您只想打印第一个过滤器的名称,为什么要对其进行迭代,只需为其编制索引并在“名称”下打印值:

for d in r['detections']:
    print(d['filters'][0]['name'])