diff options
| -rw-r--r-- | .gitignore | 3 | ||||
| -rw-r--r-- | README.md | 5 | ||||
| -rw-r--r-- | cowrieder.py | 50 |
3 files changed, 38 insertions, 20 deletions
@@ -1,2 +1,5 @@ *.json +*.json.* +*.log +*.log.* *.txt @@ -2,8 +2,11 @@ Script to help make sense of log output from popular SSH honeypot [Cowrie](https # Usage +Simply point the script to a JSON log file output by Cowrie, or a folder thereof: + ``` -cowrieder.py <args> filepath +cowrieder.py <options> /path/to/your/log.json +cowrieder.py <options> /var/log/cowrie/ ``` Options: diff --git a/cowrieder.py b/cowrieder.py index 75be8c1..01d93fe 100644 --- a/cowrieder.py +++ b/cowrieder.py @@ -174,25 +174,37 @@ def session_pingcmds(session): # Return array of all "command ping" commands use ra.append(argv0) return ra - - - -with open(filepath, "r") as logfile: # Load da file and populate da master array - for line in logfile: - entry = json.loads(line) - - if( - (not args.filter_ip or entry['src_ip'] == args.filter_ip or hashgen(entry['src_ip']) == args.filter_ip) # If it's not the IP we're filtering for don't even bother man - ): - session_id = entry['session'] - - if(args.redact_ip): - entry['src_ip'] = hashgen(entry['src_ip']) - - if(session_id not in sessions): - sessions.update({session_id: [entry]}) - else: - sessions[session_id].append(entry) +def load_json_to_array(fp): + with open(fp, "r") as logfile: # Load da file and populate da master array + for line in logfile: + entry = json.loads(line) + + if( + (not args.filter_ip or entry['src_ip'] == args.filter_ip or hashgen(entry['src_ip']) == args.filter_ip) # If it's not the IP we're filtering for don't even bother man + ): + session_id = entry['session'] + + if(args.redact_ip): + entry['src_ip'] = hashgen(entry['src_ip']) + + if(session_id not in sessions): + sessions.update({session_id: [entry]}) + else: + sessions[session_id].append(entry) + +if(os.path.isfile(filepath)): + load_json_to_array(filepath) +elif(os.path.isdir(filepath)): + # run load_json_to_array for every json file in the directory + files = {} + for f in os.listdir(filepath): + if(f[:11] == "cowrie.json" or f[-5:] == ".json"): + fi = os.path.join(filepath, f) + files.update({fi: os.path.getmtime(fi)}) + for g in dict(sorted(files.items(), key=lambda item: item[1])): + load_json_to_array(g) +else: + raise FileNotFoundError # Filtering |