diff options
| author | Ada Isopods <me@bathynomus.xyz> | 2025-05-21 00:56:36 -0600 |
|---|---|---|
| committer | Ada Isopods <me@bathynomus.xyz> | 2026-10-21 23:04:31 -0600 |
| commit | 8464204564717626b269890f1dddd615a8d7cff0 (patch) | |
| tree | bc4e2e6b3704b307bf8f899cd0d338176bf0f58f /README.md | |
| parent | e83680ba124f740094cb1c0a6981010c8558f329 (diff) | |
stat aggregation + some other stuff
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 34 |
1 files changed, 16 insertions, 18 deletions
@@ -1,4 +1,4 @@ -Script to help make sense of log output from popular SSH honeypot [Cowrie](https://github.com/cowrie/cowrie/). I think I got carried away with the specialized filtering settings. Only tested on my setup. Untested with Telnet. YMMV +Script to help make sense of log output from popular SSH honeypot [Cowrie](https://github.com/cowrie/cowrie/). I think I got carried away with the specialized filtering settings. Untested with Telnet or proxy mode. YMMV # Usage @@ -12,24 +12,22 @@ cowrieder.py <options> /var/log/cowrie/ Options: ``` - -h, --help show this help message and exit - -v, --verbose Make the output more verbose (print abridged logs for all logins where commands are run, not just the interesting ones) - -V, --verboser Make the output even more verbose (print timestamp, event id, and message (if applicable) for all events) - -W, --verbosest Make the output even more verboserer (just group the input log by session id and dump it to pretty-printed JSON) - -P, --pings Include only connections where no authentication attempt was made - -F, --fails Include only failed logins - -L, --logins Include only successful logins where no commands were run - -C, --commands Include only logins where only this list of basic test commands were run: ['uname', 'nproc'] - -E, --eventful Include only the cool interesting sessions that aren't any of that other stuff - -r, --redact-ip Redact IP addresses by converting them to 16-character hashes - -i, --filter-ip FILTER_IP - Filter data to a specific IP or censored hash thereof - -c, --no-color Don't color-code terminal output - -s, --stats Print aggregated statistics - -S, --only-stats Print only aggregated statistics +-h, --help show this help message and exit +-v, --verbose Make the output more verbose (print abridged logs for all logins where commands are run, not just the interesting ones) +-V, --verboser Make the output even more verbose (print timestamp, event id, and message (if applicable) for all events) +-W, --verbosest Make the output even more verboserer (dump as much information as possible as pretty-printed JSON) +-P, --pings Include only connections where no authentication attempt was made +-F, --fails Include only failed logins +-L, --logins Include only successful logins where no commands were run +-C, --commands Include only logins where only this list of basic test commands were run: ['uname', 'nproc'] +-E, --eventful Include only the cool interesting sessions that aren't any of that other stuff +-r, --redact-ip Redact IP addresses by converting them to 16-character hashes +-i, --filter-ip FILTER_IP + Filter data to a specific IP, censored hash thereof, or netmask (127.0.0.1 / 0b39f7265d91e7c3 / 127.0.0.0/16) +-c, --no-color Don't color-code terminal output +-s, --stats Print aggregated statistics +-S, --only-stats Print only aggregated statistics ``` # TODO -- Aggregate more stats -- Print stats on verbosity levels 2 and 3 - HTML output option
\ No newline at end of file |