woahg

Okay so I just
- Implemented argparse
- Universalized the IP filtering logic
- Added verbosity settings, finally
- Added something called "blank mode" where you can basically pick and choose what kinds of session you want to see
- Moved the filtering logic I'd already implemented in low-verbosity mode to support blank mode to its own thing so it's universal among all the verbosity modes
- Commented a bunch of stuff
- Fixed a bug I ran into where if an extra-long "empty ping" is still open when the program is run it crashes. I just realized I should probably do that for all the session types actually

I'm going to bed

1 files changed, 24 insertions, 5 deletions

diff --git a/README.md b/README.md
index 4162bd0..658c4d2 100644
--- a/README.md
+++ b/README.md
@@ -1,13 +1,32 @@
-Script to help make sense of log output from popular SSH honeypot [Cowrie](https://github.com/cowrie/cowrie/). Only tested on my setup. YMMV
+Script to help make sense of log output from popular SSH honeypot [Cowrie](https://github.com/cowrie/cowrie/). I think I got carried away with the specialized logging settings. Only tested on my setup. Untested with Telnet. YMMV
 
 # Usage
 
 ```
-python3 cowrieder.py cowrie.json
+cowrieder.py <args> filepath
 ```
 
-You can also filter it by IP address:
+Options:
 
 ```
-python3 cowrieder.py cowrie.json 127.0.0.1
-```
\ No newline at end of file
+-h, --help            show this help message and exit
+-v, --verbose         Make the output more verbose (print abridged logs for all logins where commands are run, not just the interesting ones)
+-vv, --verboser       Make the output even more verbose (print timestamp, event id, and message (if applicable) for all events)
+-vvv, --verbosest     Make the output even more verboserer (just group the input log by session id and dump it to pretty-printed JSON)
+-B, --blank           On default and low verbosity, print nothing whatsoever. Override this with other arguments to filter for only the stuff you care about
+-P, --pings           | With blank mode active, print "empty pings"
+-F, --fails           | With blank mode active, print failed logins
+-L, --logins          | With blank mode active, print "login pings"
+-C, --commands        | With blank mode active, on default verbosity, print "command pings"
+-S, --sessions        * With blank mode active, on default verbosity, print "interesting" sessions. With -v enabled, this and -C do the same thing.
+-a, --stats           Print aggregated statistics
+-j, --json-stats      Dump aggregated statistics as JSON
+-i, --filter-ip FILTER_IP
+                      Filter data to a specific IP
+```
+
+# Terminology
+
+- "Empty ping": Client connected and made no attempt to log in
+- "Login ping": Client logged in successfully and did nothing
+- "Command ping": Client logged in successfully and only ran `uname`, `nproc`, and/or `echo`. In my experience "command pings" comprise most insances of a client successfully logging in and then bothering to run any commands
\ No newline at end of file