I have a python script that is supposed to take a directory full of .txt files and determine if each .txt file return positive or negative for matching certain text statements inside the file itself like "known infection source". However, my script doesn't work and returns the following error message. Any help would be greatly appreciated!
Sample JSON file text
{
"detected_referrer_samples": [
{
"positives": 1,
"sha256": "325f928105efb4c227be1a83fb3d0634ec5903bdfce2c3580ad113fc0f15373c",
"total": 52
},
{
"positives": 20,
"sha256": "48d85943ea9cdd1e480d73556e94d8438c1b2a8a30238dff2c52dd7f5c047435",
"total": 53
}
],
"detected_urls": [],
"domain_siblings": [],
"resolutions": [],
"response_code": 1,
"verbose_msg": "Domain found in dataset",
"whois": null
}
Error
Traceback (most recent call last):
File "vt_reporter1.py", line 35, in <module>
print(vt_result_check(path))
File "vt_reporter1.py", line 20, in vt_result_check
vt_result |= any(sample['positives'] > 0 for sample_type in sample_types
File "vt_reporter1.py", line 21, in <genexpr>
for sample in vt_data.get(sample_type, []))
AttributeError: 'list' object has no attribute 'get'
Code
import os
import json
import csv
path=r'./output/'
csvpath='C:/Users/bwerner/Documents'
def vt_result_check(path):
vt_result = False
for filename in os.listdir(path):
with open(path + filename, 'r') as vt_result_file:
vt_data = json.load(vt_result_file)
# Look for any positive detected referrer samples
# Look for any positive detected communicating samples
# Look for any positive detected downloaded samples
# Look for any positive detected URLs
sample_types = ('detected_referrer_samples', 'detected_communicating_samples',
'detected_downloaded_samples', 'detected_urls')
vt_result |= any(sample['positives'] > 0 for sample_type in sample_types
for sample in vt_data.get(sample_type, []))
# Look for a Dr. Web category of known infection source
vt_result |= vt_data.get('Dr.Web category') == "known infection source"
# Look for a Forecepoint ThreatSeeker category of elevated exposure
# Look for a Forecepoint ThreatSeeker category of phishing and other frauds
# Look for a Forecepoint ThreatSeeker category of suspicious content
threats = ("elevated exposure", "phishing and other frauds", "suspicious content")
vt_result |= vt_data.get('Forcepoint ThreatSeeker category') in threats
return vt_result
if __name__ == '__main__':
print(vt_result_check(path))
with open(csvpath, 'w') as csvfile:
writer.writerow([vt_result_check(path)])
listnot adict.listcontaining adict, like in this question: stackoverflow.com/questions/25613565/…