Skip to content

Instantly share code, notes, and snippets.

@hakanbaysal
Created May 7, 2020 14:28
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save hakanbaysal/ab371a9989d240c2c8c688765ac8150a to your computer and use it in GitHub Desktop.
Save hakanbaysal/ab371a9989d240c2c8c688765ac8150a to your computer and use it in GitHub Desktop.
Json Process
import json
from jsonpath_ng import jsonpath, parse
class Hero:
def __init__(self):
print('hero')
self.json = {}
self.new_json = {}
self.path = ""
self.control_json_path = False
def import_mapping_file(self, path):
f = open(path, "r", encoding='utf-8')
self.json = json.loads(f.read())
return self.json
def parser_json(self, json_body):
for key, value in json_body.items():
print('------------------------')
# Open comment for Fireeye and LastLine
'''if key == 'activity_to_mitre_techniques':
continue
elif key == 'applets':
continue'''
if self.control_json_path:
jsonpath_expr = parse('$..'+key)
match = jsonpath_expr.find(self.json)
self.control_json_path = False
control = False
for item in match:
if self.path.replace("['", "").replace("']", ".")[0:-1] == str(item.full_path.left):
control = True
break
for item in match:
if self.path.replace("['", "").replace("']", ".")[0:-1] != str(item.full_path.left) \
and len(item.value) > 0 and item.value == value and not control:
self.path = "['"+"']['".join(str(item.full_path.left).split('.'))+"']"
break
print(self.path)
print(key)
print(value)
if isinstance(value, dict):
if key == 'properties':
self.combine(value, self.path)
self.parser_json(value)
elif list(value.keys())[0] != 'type' and isinstance(list(value.values())[0], dict):
self.path += "['"+key+"']"
self.parser_json(value)
else:
self.control_json_path = True
self.combine("\"\"", self.path+"['"+key+"']")
else:
self.combine("\"\"", self.path)
print('bitti')
def combine(self, value, path):
print('######')
code = "self.json" + str(path) + " = "+str(value)
exec(code)
print(self.json)
print('######')
if __name__:
target_file = "./mappings/lastline_full.json"
h = Hero()
body = h.import_mapping_file(target_file)
h.parser_json(body)
print(h.json)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment