0

Running into a frustrating problem processing data in go. I have a list of interfaces

[SUSPENDED_PROCESS]
[MITRE_T1055_PROCESS_INJECT MODIFY_PROCESS]
<nil>
<nil>
[ENUMERATE_PROCESSES MITRE_T1057_PROCESS_DISCOVERY]
[MODIFY_MEMORY_PROTECTION]
<nil>
[SUSPENDED_PROCESS]
[MODIFY_MEMORY_PROTECTION]
<nil>
[SUSPENDED_PROCESS]
<nil>
[MODIFY_MEMORY_PROTECTION]
<nil>
<nil>
[SUSPENDED_PROCESS]
[MITRE_T1055_PROCESS_INJECT MODIFY_PROCESS]

I want to combine this []interface{} into one interface{}, excluding nil values and dedupping. This is my code thus far.

for _, event := range results.([]interface{}) {
            if tid, found := event.(map[string]interface{})["threatIndicators"]; found {
                fmt.Println(tid) //these are the interfaces i want to merge
                if tid != nil { //concatenate all non null tids
                    for k, v := range tid.([]interface{}) { //iterate through each tid
                        tidList[k] = v
                        // fmt.Println(tidList)
                    }
                }
            }
}

The problem I am encountering is these maps have non unique keys (the key is the index in the map). So my code will overwrite if keys are the same, which will happen in this case. Is there a way to do this? In python it would be a simple list comprehension but I am struggling to see how to accomplish this in Go. End result would be one map containing all these values ideally. I unfortunately do not have control over this structure, I am parsing data from an api.

2
  • 1
    what you want to do if the keys are exist ? Apr 22, 2020 at 17:06
  • 1
    Can you provide a minimal reproducible example that at least shows what your data actually looks like? And what would you want the results to look like? Apr 22, 2020 at 17:32

1 Answer 1

3

If you have multiple entries with the same key and you don't want to lose data then you can store the data in a map of slices:

map[string][]interface{}

Then instead of overwriting you would append for each key:

tidList[k] = append(tidlist[k], v)

Another option could be to find a unique value inside the threatIndicators, like an id, and use that as the key.

1
  • Thanks! this was exactly what I needed
    – GoMonkey
    Apr 22, 2020 at 17:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.