Q:

Python manipulating json, lists, and dictionaries

Sorry for the length but tried to be complete. 
I'm trying to get the following data - 
(only small sampling from a much larger json file, same structure)
{
    "count": 394,
    "status": "ok",
    "data": [
        {
            "md5": "cd042ba78d0810d86755136609793d6d",
            "threatscore": 90,
            "threatlevel": 0,
            "avdetect": 0,
            "vxfamily": "",
            "domains": [
                "dynamicflakesdemo.com",
                "www.bountifulbreast.co.uk"
            ],
            "hosts": [
                "66.33.214.180",
                "64.130.23.5",
            ],
            "environmentId": "1",
        },
        {
            "md5": "4f3a560c8deba19c5efd48e9b6826adb",
            "threatscore": 65,
            "threatlevel": 0,
            "avdetect": 0,
            "vxfamily": "",
             "domains": [
                "px.adhigh.net"
            ],
            "hosts": [
                "130.211.155.133",
                "65.52.108.163",
                "172.225.246.16"
            ],
            "environmentId": "1",
        }
    ]
}

if "threatscore" is over 70 I want to add it to this json structure - 
Ex. 
        "data": [
            {
                "md5": "cd042ba78d0810d86755136609793d6d",
                "threatscore": 90,
{
"Event":
    {"date":"2015-11-25",
    "threat_level_id":"1",
    "info":"HybridAnalysis",
    "analysis":"0",
    "distribution":"0",
    "orgc":"SOC", 
    "Attribute": [
        {"type":"ip-dst",
        "category":"Network activity",
        "to_ids":True,
        "distribution":"3",
        "value":"66.33.214.180"},
        {"type":"ip-dst",
        "category":"Network activity",
        "to_ids":True,
        "distribution":"3",
        "value":"64.130.23.5"}
        {"type":"domain",
        "category":"Network activity",
        "to_ids":True,
        "distribution":"3",
        "value":"dynamicflakesdemo.com"},
        {"type":"domain",
        "category":"Network activity",
        "to_ids":True,
        "distribution":"3",
        "value":"www.bountifulbreast.co.uk"}
        {"type":"md5",
        "category":"Payload delivery",
        "to_ids":True,
        "distribution":"3",
        "value":"cd042ba78d0810d86755136609793d6d"}]
}
}

This is my code - 
from datetime import datetime
import os
import json
from pprint import pprint

now = datetime.now()

testFile = open("feed.json")
feed = json.load(testFile)

for x in feed['data']:
    if x['threatscore'] > 90:
        data = {}
        data['Event']={}
        data['Event']["date"] = now.strftime("%Y-%m-%d")
        data['Event']["threat_level_id"] = "1"
        data['Event']["info"] = "HybridAnalysis"
        data['Event']["analysis"] = 0
        data['Event']["distribution"] = 3
        data['Event']["orgc"] = "Malware"
        data['Event']["Attribute"] = []
        if 'hosts' in x:
            data['Event']["Attribute"].append({'type': "ip-dst"})
            data['Event']["Attribute"][0]["category"] = "Network activity"
            data['Event']["Attribute"][0]["to-ids"] = True
            data['Event']["Attribute"][0]["distribution"] = "3"
            data["Event"]["Attribute"][0]["value"] =x['hosts'] 
        if 'md5' in x:
            data['Event']["Attribute"].append({'type': "md5"})
            data['Event']["Attribute"][1]["category"] = "Payload delivery"
            data['Event']["Attribute"][1]["to-ids"] = True
            data['Event']["Attribute"][1]["distribution"]  = "3"
            data['Event']["Attribute"][1]['value'] = x['md5']
        if 'domains' in x:
            data['Event']["Attribute"].append({'type': "domain"})
            data['Event']["Attribute"][2]["category"] = "Network activity"
            data['Event']["Attribute"][2]["to-ids"] = True
            data['Event']["Attribute"][2]["distribution"] = "3"
            data['Event']["Attribute"][2]["value"] = x['domains']
        attributes = data["Event"]["Attribute"]
        data["Event"]["Attribute"] = []
        for attribute in attributes:
            for value in attribute["value"]:
                    if value == " ":
                        pass
                    else:
                        new_attr = attribute.copy()
                        new_attr["value"] = value
                        data["Event"]["Attribute"].append(new_attr)
        pprint(data)

with open('output.txt', 'w') as outfile:
    json.dump(data, outfile)

And now it seems to be cleaned up a little but the data['md5'] is being split on each letter and I think it's just like L3viathan said earlier I keep overwriting the first element in the dictionary... but I'm not sure how to get it to keep appending???
{'Event': {'Attribute': [{'category': 'Network activity',
                          'distribution': '3',
                          'to-ids': True,
                          'type': 'ip-dst',
                          'value': u'216.115.96.174'},
                         {'category': 'Network activity',
                          'distribution': '3',
                          'to-ids': True,
                          'type': 'ip-dst',
                          'value': u'64.4.54.167'},
                         {'category': 'Network activity',
                          'distribution': '3',
                          'to-ids': True,
                          'type': 'ip-dst',
                          'value': u'63.250.200.37'},
                         {'category': 'Payload delivery',
                          'distribution': '3',
                          'to-ids': True,
                          'type': 'md5',
                          'value': u'7'},
                         {'category': 'Payload delivery',
                          'distribution': '3',
                          'to-ids': True,
                          'type': 'md5',
                          'value': u'1'},

And still getting the following error in the end:
Traceback (most recent call last):
  File "hybridanalysis.py", line 34, in 
    data['Event']["Attribute"][1]["category"] = "Payload delivery"
IndexError: list index out of range
The final goal is to get it set so that I can post the events into MISP but they have to go one at a time. 

A:

I think this should fix your problems. I added the attribute dictionary all in one go, and moved the data in a list (which is more appropriate), but you might want to remove the superfluous list which wraps the Events.
from datetime import datetime
import os
import json
from pprint import pprint

now = datetime.now()

testFile = open("feed.json")
feed = json.load(testFile)

data_list = []

for x in feed['data']:
    if x['threatscore'] > 90:
        data = {}
        data['Event']={}
        data['Event']["date"] = now.strftime("%Y-%m-%d")
        data['Event']["threat_level_id"] = "1"
        data['Event']["info"] = "HybridAnalysis"
        data['Event']["analysis"] = 0
        data['Event']["distribution"] = 3
        data['Event']["orgc"] = "Malware"
        data['Event']["Attribute"] = []
        if 'hosts' in x:
            data['Event']["Attribute"].append({
                'type': 'ip-dst',
                'category': 'Network activity',
                'to-ids': True,
                'distribution': '3',
                'value': x['hosts']})
        if 'md5' in x:
            data['Event']["Attribute"].append({
                'type': 'md5',
                'category': 'Payload delivery',
                'to-ids': True,
                'distribution': '3',
                'value': x['md5']})
        if 'domains' in x:
            data['Event']["Attribute"].append({
                'type': 'domain',
                'category': 'Network activity',
                'to-ids': True,
                'distribution': '3',
                'value': x['domains']})
        attributes = data["Event"]["Attribute"]
        data["Event"]["Attribute"] = []
        for attribute in attributes:
            for value in attribute["value"]:
                    if value == " ":
                        pass
                    else:
                        new_attr = attribute.copy()
                        new_attr["value"] = value
                        data["Event"]["Attribute"].append(new_attr)
        data_list.append(data)

with open('output.txt', 'w') as outfile:
    json.dump(data_list, outfile)

