问查找特定单词的Regex

EN

{"author":["frack113"],"description":"Detects a Sysmon configuration change, which could be the result of a legitimate reconfiguration or someone trying manipulate the configuration","ruleId":"8ac03a65-6c84-4116-acad-dc1558ff7a77","falsePositives":["Legitimate administrative action"],"from":"now-360s","immutable":false,"outputIndex":".siem-signals-default","meta":{"from":"1m"},"maxSignals":100,"riskScore":35,"riskScoreMapping":[],"severity":"medium","severityMapping":[],"threat":[{"tactic":{"id":"TA0005","reference":"https://attack.mitre.org/tactics/TA0005","name":"Defense Evasion"},"framework":"MITRE ATT&CK®","technique":[]}],"to":"now","references":["https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"],"version":1,"exceptionsList":[],"index":["winlogbeat-*"],"query":"(winlog.channel:\"Microsoft\\-Windows\\-Sysmon\\/Operational\" AND winlog.event_id:\"16\")","language":"lucene","filters":[],"type":"query"},"schedule":{"interval":"5m"}}

def main():
    with open('data.txt') as f:
        for line in f:
            
            line = line.split("query")
            result = line[1]
            result = result.split(")")
            result = result[0][2:]

            print(result)

main()                      

"(winlog.channel:\"Microsoft\\-Windows\\-Sysmon\\/Operational\" AND winlog.event_id:\"16\"

import json

file = 'exportedSignal.ndjson'
with open(file, 'r', encoding = 'cp850') as f:
    jsonData = json.load(f)

queries = []
hits = jsonData['hits']['hits']
for hit in hits:
    if 'query' in hit['_source']['alert']['params'].keys():
        query = hit['_source']['alert']['params']['query']
        queries.append(query)
print(queries)

import re

file = 'exportedSignal.ndjson'
with open(file, 'r', encoding = 'cp850') as f:
    data = f.read()

queries = re.findall('\"query\":\"(.*?)\"', data)
print(queries)