Script to help make sense of log output from popular SSH honeypot Cowrie. I think I may have gotten carried away with the filtering settings and statistics aggregation. Untested with Telnet or proxy mode. YMMV
Usage
Simply point the script to a JSON log file output by Cowrie, or a folder thereof:
cowrieder.py <options> /path/to/your/log.json
cowrieder.py <options> /var/log/cowrie/
Options:
-h -h, --help show this help message and exit
-v, --verbose Make the output more verbose (do less to collapse less-interesting information)
-V, --verboser Make the output even more verbose (one line per event)
-W, --verbosest Make the output even more verboserer (dump as much information as possible as pretty-printed JSON)
-P, --pings Include only connections where no authentication attempt was made
-F, --fails Include only failed logins
-L, --logins Include only successful logins where no commands were run
-C, --commands Include only logins where only this list of basic test commands were run: ['uname', 'nproc']
-E, --eventful Include only the cool interesting sessions that aren't any of that other stuff
-u, --filter-username FILTER_USERNAME
Filter data to uses of a specific username
-p, --filter-password FILTER_PASSWORD
Filter data to uses of a specific password. Pass "[SSH_PUBKEY_ATTEMPT]" to filter for attempts to log in using an SSH public key instead of a password, which does happen
-z, --filter-sensor FILTER_SENSOR
Filter data to a certain "sensor". Useful if Cowrie is running in proxy mode to multiple endpoints
-i, --filter-ip FILTER_IP
Filter data to a specific IP, censored hash thereof, or netmask (127.0.0.1 / 0b39f7265d91e7c3 / 127.0.0.0/16)
-r, --redact-ip Redact IP addresses by converting them to 16-character hashes
-c, --no-color Don't color-code terminal output
-s, --stats Print aggregated statistics
-S, --only-stats Print only aggregated statistics
-m, --html Output an overview as an HTML webpage, GoAccess-style. Ignores previous two options.
TODO
- Filter by regex?