如何遍历列表嵌套列表嵌套字典结构提取指定ID的杀毒软件动作值

需求 #

从嵌套的列表-字典结构中提取杀毒软件的执行动作，需满足：

• 目标字典的id为5或6
• 目标字典的value为File cleaned或Quarantine Successfully
  每个子列表对应一个结果，无符合条件项时用-填充。

给定数据结构 #

data = [
    [
        {
            "id": 1,
            "type": "detection_name",
            "field": "malName",
            "value": "HKTL_AMMYYADMIN",
            "provenance": [
                "Alert"
            ]
        },
        {
            "id": 2,
            "type": "file_sha1",
            "field": "fileHash",
            "value": "",
            "provenance": [
                "Alert"
            ]
        },
        {
            "id": 3,
            "type": "filename",
            "field": "fileName",
            "value": "D:\\PAMH\\DATA\\LABORTATORY\\AMMYY_Admin.exe",
            "provenance": [
                "Alert"
            ]
        },
        {
            "id": 4,
            "type": "fullpath",
            "field": "fullPath",
            "value": "D:\\PAMH\\DATA\\LABORTATORY\\AMMYY_Admin.exe",
            "provenance": [
                "Alert"
            ]
        },
        {
            "id": 5,
            "type": "text",
            "field": "actResult",
            "value": "File cleaned",
            "provenance": [
                "Alert"
            ]
        },
        {
            "id": 6,
            "type": "text",
            "field": "scanType",
            "value": "Real-time Scan",
            "provenance": [
                "Alert"
            ]
        }
    ],
    [
        {
            "id": 1,
            "type": "command_line",
            "field": "objectCmd",
            "value": "c:\\SW\\nmap\\nmap.exe  -sS -P0 92.168.155.83 -p 22",
            "provenance": [
                "Alert"
            ]
        }
    ],
    [
        {
            "id": 1,
            "type": "detection_name",
            "field": "malName",
            "value": "HackTool.Win32.PortScan.SWO",
            "provenance": [
                "Alert"
            ]
        },
        {
            "id": 2,
            "type": "file_sha1",
            "field": "fileHash",
            "value": "",
            "provenance": [
                "Alert"
            ]
        },
        {
            "id": 3,
            "type": "filename",
            "field": "fileName",
            "value": "E:\\EXCHANGE\\John Smith\\Documents\\Advanced_Port_Scanner_2.5.3869.exe",
           "provenance": [
                "Alert"
            ]
        },
        {
            "id": 4,
            "type": "filename",
            "field": "fileName",
            "value": "H:\\home\\john.smith\\Documents\\Advanced_Port_Scanner_2.5.3869.exe",
            "provenance": [
                "Alert"
            ]
        },
        {
            "id": 5,
            "type": "fullpath",
            "field": "fullPath",
            "value": "H:\\home\\john.smith\\Documents\\Advanced_Port_Scanner_2.5.3869.exe",
            "provenance": [
                "Alert"
            ]
        },
        {
            "id": 6,
            "type": "text",
            "field": "actResult",
            "value": "File cleaned",
            "provenance": [
                "Alert"
            ]
        },
        {
            "id": 7,
            "type": "text",
            "field": "actResult",
            "value": "File cleaned",
            "provenance": [
                "Alert"
            ]
        },
        {
            "id": 8,
            "type": "text",
            "field": "scanType",
            "value": "Scheduled Scan",
            "provenance": [
                "Alert"
            ]
        }
    ]
]

解决方案代码 #

# 定义目标条件
target_ids = {5, 6}
target_values = {"File cleaned", "Quarantine Successfully"}

results = []
for sublist in data:
    action = "-"
    for item in sublist:
        # 检查是否满足id和value的条件
        if item["id"] in target_ids and item["value"] in target_values:
            action = item["value"]
            break  # 找到第一个符合条件的项就停止遍历当前子列表
    results.append(f'"{action}"')

# 按期望格式输出
print(", ".join(results))

执行结果 #

"File cleaned", "-", "File cleaned"

内容的提问来源于stack exchange，提问作者OverflowStack