mgreen27.github.io | Matt's DFIR blog

import yaml
import json

data = {}
data['indicator'] = {}
data['indicator']['detection']=[]
data['indicator']['fields']=[]
data['indicator']['falsepositives']=[]
data['indicator']['level']=[]

def parse_string(s, data):
    doc = next(yaml.safe_load_all(s))

    data['indicator']['detection'].append(doc['detection'])
    data['indicator']['fields'].append(doc['fields'])
    data['indicator']['falsepositives'].append(doc['falsepositives'])
    data['indicator']['level'].append(doc['level'])

with open(yaml_file, 'r') as yaml_in, open(json_file, 'a') as definition:
    parse_string(yaml_in.read(), data)
    json.dump(data, definition, indent=4)