diff options
| author | Ada Isopods <me@bathynomus.xyz> | 2025-05-17 05:08:56 -0600 |
|---|---|---|
| committer | Ada Isopods <me@bathynomus.xyz> | 2026-10-21 23:04:29 -0600 |
| commit | 8fd7d671c58f7c3b84b0c2ba5fe628742c8c2590 (patch) | |
| tree | 443a73d5ce4b735127e42135fd7af6e1ee5e01a6 /README.md | |
| parent | 481cb1e457c3951b3b7385859572b8d6d16a7cdb (diff) | |
ip stats
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 34 |
1 files changed, 21 insertions, 13 deletions
@@ -12,16 +12,24 @@ cowrieder.py <options> /var/log/cowrie/ Options: ``` --h, --help show this help message and exit --v, --verbose Make the output more verbose (print abridged logs for all logins where commands are run, not just the interesting ones) --V, --verboser Make the output even more verbose (print timestamp, event id, and message (if applicable) for all events) --W, --verbosest Make the output even more verboserer (just group the input log by session id and dump it to pretty-printed JSON) --P, --pings Include only connections where no authentication attempt was made --F, --fails Include only failed logins --L, --logins Include only successful logins where no commands were run --C, --commands Include only logins where only this list of basic test commands were run: ['uname', 'nproc', 'echo'] --E, --eventful Include only the cool interesting sessions that aren't any of that other stuff --r, --redact-ip Redact IP addresses by converting them to 16-character hashes --i, --filter-ip FILTER_IP - Filter data to a specific IP or censored hash thereof -```
\ No newline at end of file + -h, --help show this help message and exit + -v, --verbose Make the output more verbose (print abridged logs for all logins where commands are run, not just the interesting ones) + -V, --verboser Make the output even more verbose (print timestamp, event id, and message (if applicable) for all events) + -W, --verbosest Make the output even more verboserer (just group the input log by session id and dump it to pretty-printed JSON) + -P, --pings Include only connections where no authentication attempt was made + -F, --fails Include only failed logins + -L, --logins Include only successful logins where no commands were run + -C, --commands Include only logins where only this list of basic test commands were run: ['uname', 'nproc'] + -E, --eventful Include only the cool interesting sessions that aren't any of that other stuff + -r, --redact-ip Redact IP addresses by converting them to 16-character hashes + -i, --filter-ip FILTER_IP + Filter data to a specific IP or censored hash thereof + -c, --no-color Don't color-code terminal output + -s, --stats Print aggregated statistics + -S, --only-stats Print only aggregated statistics +``` + +# TODO +- Aggregate more stats +- Print stats on verbosity levels 2 and 3 +- HTML output option
\ No newline at end of file |