Python Object Iteration

Question

Can someone provide an example of how to loop through this object in python and pull out 'value' where api = 'interesting' and arguments.name = 'FileName'?

Here is what I have so far.
This object has many more processes and calls....output has been omitted.

edit: I should mention that I am getting the following error when running this code: "TypeError: list indices must be integers, not str"

for k, v in object['behavior']['processes']['calls'].items():
            if v['api'] == "interesting":
                           <loop through arguments next>

Object:

{"behavior": {
    "processes": [
        {
        "parent_id": "312", 
        "process_name": "test.exe", 
        "process_id": "1184", 
        "first_seen": "2013-03-02 17:22:48,359", 
        "calls": [
            {
            "category": "filesystem", 
            "status": "FAILURE", 
            "return": "0xc000003a", 
            "timestamp": "2013-03-02 17:22:48,519", 
            "thread_id": "364", 
            "repeated": 0, 
            "api": "interesting", 
            "arguments": [
                {
                "name": "FileHandle", 
                "value": "0x00000000"
                }, 
                {
                "name": "DesiredAccess", 
                "value": "0x80100080"
                }, 
                {
                "name": "FileName", 
                "value": "c:\\cgvi5r6i\\vgdgfd.72g"
                }, ...

What's wrong with carrying on with what you've started?

lxop
– lxop

2013-03-11 03:00:52 +00:00
Commented Mar 11, 2013 at 3:00 — lxop
– lxop, Commented Mar 11, 2013 at 3:00

lxop · Accepted Answer · 2013-03-11 03:35:00Z

1

What you've given as a starter in the question won't work because you are not iterating through the elements of the lists that are the values to the keys "processes" and "calls" respectively. That is, you will need something more like

for proc in object ['processes']:
    for call in proc ['calls']:
        if call ['api'] == "interesting":
            fname = None
            for arg in call ['arguments']:
                if arg ['name'] == "FileName":
                    fname = arg ['value']

Then the file name you're looking for will be in fname. This has no error checking, since I don't know where your data has come from.

edited Mar 11, 2013 at 3:35

answered Mar 11, 2013 at 3:14

lxop

8,6523 gold badges32 silver badges46 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Mike Over a year ago

Everyone who has provided input has been correct but in the end I wound up using this code. Thank you all very much.

pradyunsg · Accepted Answer · 2013-03-11 03:53:15Z

What you're doing seems OK, but

Your indexes are off (look carefully there are lists
Your check seems to be invalid (v is a string, so v['api'] is invalid).

So, try doing this instead, (I've taken your object as i)

for k, v in i['behavior']['processes'][0]['calls'][0].items():
    if k == 'api' and v == "interesting":
        print k,v

OR

for dct in i['behavior']['processes'][0]['calls']:
    if dct['api'] == "interesting":
        print 'api',dct['api']

OR

for dct in i['behavior']['processes'][0]['calls']:
    for k,v in dct.items():
        if k == 'api' and  v =="interesting":
            print 'api',dct['api']

OR if the there are multiple parts to each list,

for proc in i['behavior']['processes']:
    for call in proc['calls']:
        print 'api =>',call['api'] # a if here
        for args in call['arguments']:
            print '   argument.name =>',args['name'] # and another if here should do the trick.

Why you get the error
Try the following piece of code, and you'll understand what you were doing wrong

print type(i['behavior']['processes'])
print type(i['behavior']['processes'][0])
print type(i['behavior']['processes'][0]['calls'])
print type(i['behavior']['processes'][0]['calls'][0])

linbo · Accepted Answer · 2013-03-11 03:13:28Z

0

object['behavior']['processes']['calls']

is a list, not dict.

answered Mar 11, 2013 at 3:13

linbo

2,4313 gold badges23 silver badges45 bronze badges

Collectives™ on Stack Overflow

Python Object Iteration

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

1 Comment

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related