用jq打印virustotal API的输出。

Question

我想把 VirusTotal API 的 json 输出格式化，以便在一个概览中提供所有相关数据。VirusTotal API可以像这样通过curl调用（你需要先regiser获取API密钥，传递的数据是你怀疑是恶意软件的文件的哈希值）。

curl --silent https://www.virustotal.com/vtapi/v2/file/report -F apikey=$VTAPI -F resource=b2349998571ab733d4ee0ca8a82afa614527aec75679569a91940631851c3d2b

输出的数据是json格式的 所以jq是让这个人类可读的方法。

curl --silent https://www.virustotal.com/vtapi/v2/file/report -F apikey=$VTAPI -F resource=b2349998571ab733d4ee0ca8a82afa614527aec75679569a91940631851c3d2b | jq "."

这样就会有如下的结果（11个引擎检测到该文件为恶意软件，请在VT网站上查看permalink URL）。

{
  "scans": {
    "Bkav": {
      "detected": false,
      "version": "1.3.0.9899",
      "result": null,
      "update": "20200418"
    },
    "TotalDefense": {
      "detected": false,
... etc.
  "resource": "b2349998571ab733d4ee0ca8a82afa614527aec75679569a91940631851c3d2b",
  "response_code": 1,
  "scan_date": "2020-04-18 12:36:44",
  "permalink": "https://www.virustotal.com/file/b2349998571ab733d4ee0ca8a82afa614527aec75679569a91940631851c3d2b/analysis/1587213404/",
  "verbose_msg": "Scan finished, information embedded",
  "total": 61,
  "positives": 11,
  "sha256": "b2349998571ab733d4ee0ca8a82afa614527aec75679569a91940631851c3d2b",
  "md5": "a860ff8b038de1ab70706163f4adf955"
}

我把VT的完整json输出放在 糊状物

我想要的是，只显示检测到的==true的记录，并将其格式化，使所有相关信息都能在一个概览中看到，而不需要向后滚动。我可以做一个perl脚本来实现这个目的，但由于jq是如此强大，我希望它也可以将所有的东西都格式化在那里？

MicroWorld-eScan        14.0.409.0      20200418        Trojan.GenericKD.42992262
McAfee                  6.0.6.653       20200417        Artemis!A860FF8B038D
...
"scan_id": "b2349998571ab733d4ee0ca8a82afa614527aec75679569a91940631851c3d2b-1587213404",
"sha1": "155f680dfc91b0f90976c0892bb883f7a360e041",
"resource": "b2349998571ab733d4ee0ca8a82afa614527aec75679569a91940631851c3d2b",
"response_code": 1,
"scan_date": "2020-04-18 12:36:44",
"permalink": "https://www.virustotal.com/file/b2349998571ab733d4ee0ca8a82afa614527aec75679569a91940631851c3d2b/analysis/1587213404/",
"verbose_msg": "Scan finished, information embedded",
"total": 61,
"positives": 11,
"sha256": "b2349998571ab733d4ee0ca8a82afa614527aec75679569a91940631851c3d2b",
"md5": "a860ff8b038de1ab70706163f4adf955"

我试过用jq做一些东西，但是我没有得到很好的效果:(

% jq '.scans[] | "\(.detected)" + "   " + .result' vt-json.txt | grep -v false
"true   Trojan.GenericKD.42992262"
"true   Artemis!A860FF8B038D"
"true   Trojan.Generic.D2900286"
"true   Trojan.GenericKD.42992262"
"true   Trojan.PDF.Generic.O!c"
"true   Trojan.GenericKD.42992262"
"true   Trojan.GenericKD.42992262 (B)"
"true   Artemis"
"true   malware (ai score=86)"
"true   Trojan.GenericKD.42992262"
"true   Trojan.GenericKD.42992262"

还有

jq '. | select( .scans[].detected == true ) | .result ' vt-json.txt
null
null
null
null
null
null
null
null
null
null
null

谢谢你的帮助，Ewald... ...

Answer 1

你可以得到一个接近你所显示的输出，但在有效的json与此。

jq '
    .scans |= with_entries(
        select(.value.detected)
        | .value |= .version + " / " + .update + " / " + .result
    )
' vt-json.txt

---

{
  "scans": {
    "MicroWorld-eScan": "14.0.409.0 / 20200418 / Trojan.GenericKD.42992262",
    "McAfee": "6.0.6.653 / 20200417 / Artemis!A860FF8B038D",
    "Arcabit": "1.0.0.870 / 20200418 / Trojan.Generic.D2900286",
    "BitDefender": "7.2 / 20200418 / Trojan.GenericKD.42992262",
    "AegisLab": "4.2 / 20200418 / Trojan.PDF.Generic.O!c",
    "Ad-Aware": "3.0.5.370 / 20200418 / Trojan.GenericKD.42992262",
    "Emsisoft": "2018.12.0.1641 / 20200418 / Trojan.GenericKD.42992262 (B)",
    "McAfee-GW-Edition": "v2017.3010 / 20200418 / Artemis",
    "MAX": "2019.9.16.1 / 20200418 / malware (ai score=86)",
    "ALYac": "1.1.1.5 / 20200418 / Trojan.GenericKD.42992262",
    "GData": "A:25.25440B:26.18419 / 20200418 / Trojan.GenericKD.42992262"
  },
  "scan_id": "b2349998571ab733d4ee0ca8a82afa614527aec75679569a91940631851c3d2b-1587213404",
  "sha1": "155f680dfc91b0f90976c0892bb883f7a360e041",
  "resource": "b2349998571ab733d4ee0ca8a82afa614527aec75679569a91940631851c3d2b",
  "response_code": 1,
  "scan_date": "2020-04-18 12:36:44",
  "permalink": "https://www.virustotal.com/file/b2349998571ab733d4ee0ca8a82afa614527aec75679569a91940631851c3d2b/analysis/1587213404/",
  "verbose_msg": "Scan finished, information embedded",
  "total": 61,
  "positives": 11,
  "sha256": "b2349998571ab733d4ee0ca8a82afa614527aec75679569a91940631851c3d2b",
  "md5": "a860ff8b038de1ab70706163f4adf955"
}

过滤器 select(.value.detected) 移除没有检测到任何东西的工具，而过滤器 .version + " / " + .update + " / " + .result 在检测到阳性的情况下，格式化输出。