Skip to content

Instantly share code, notes, and snippets.

@helb
Created March 14, 2018 17:15
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save helb/9b20fb56c37e2dbae2b07dc550740fc4 to your computer and use it in GitHub Desktop.
Save helb/9b20fb56c37e2dbae2b07dc550740fc4 to your computer and use it in GitHub Desktop.
fx json to csv

example input:

[helb@kookaburra~/tmp/alienvault] $ cat input.json 
{
    "indicators": [
        {
            "indicator": "127.0.0.1",
            "description": "",
            "created": "2018-03-13T00:53:33",
            "title": "",
            "content": "",
            "type": "IP",
            "id": 436388206
        },
        {
            "indicator": "624762a90b7272e247e5022576b7912d1aa0b32bc13aabc7ee47197e5b87a41b",
            "description": "",
            "created": "2018-03-13T00:53:33",
            "title": "",
            "content": "",
            "type": "FileHash-SHA256",
            "id": 436388207
        }
    ]
}

convert to CSV:

[helb@kookaburra~/tmp/alienvault] $ cat input.json | fx 'o => (o.indicators.map(i => `${i.type}, ${i.indicator}`)).join(", ")'
               
IP, 127.0.0.1, FileHash-SHA256, 624762a90b7272e247e5022576b7912d1aa0b32bc13aabc7ee47197e5b87a41b

filtering just IPs:

[helb@kookaburra~/tmp/alienvault] $ cat input.json | fx 'o => (o.indicators.filter(i => i.type == "IP").map(i => `${i.type}, ${i.indicator}`)).join(", ")'
                             
IP, 127.0.0.1

(just the .filter(i => i.type == "IP") part was added)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment