3 files changed, 41 insertions, 0 deletions
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..b9bc715
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+cowrie.json
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..e4ca15d
--- /dev/null
+++ b/README.md
@@ -0,0 +1 @@
+Script to help make sense of log output from popular SSH honeypot [Cowrie](https://github.com/cowrie/cowrie/). Only tested on my setup. YMMV
+\ No newline at end of file
diff --git a/cowrieder.py b/cowrieder.py
new file mode 100644
index 0000000..707f4a0
--- /dev/null
+++ b/cowrieder.py
@@ -0,0 +1,39 @@
+import json
+import sys
+import random
+
+if(len(sys.argv) < 2):
+  print("Provide a path to a Cowrie JSON log file")
+  exit()
+filepath = sys.argv[1]
+entries = []
+sessions = []
+ips = {}
+
+with open(filepath, "r") as logfile:
+  for line in logfile:
+    entry = json.loads(line)
+    entries.append(entry)
+    session = entry['session']
+    if(session not in sessions):
+      sessions.append(session)
+      ips.update({session: entry['src_ip']})
+
+for session in sessions:
+  ip = ips[session]
+  random.seed(session)
+  sr = random.randrange(50, 256)
+  sg = random.randrange(50, 256)
+  sb = random.randrange(50, 256)
+  random.seed(ip)
+  ir = random.randrange(50, 256)
+  ig = random.randrange(50, 256)
+  ib = random.randrange(50, 256)
+  print("\n--- Session \x1b[38;2;{r};{g};{b}m".format(r=sr, g=sg, b=sb) + session + "\x1b[0m from \x1b[38;2;{r};{g};{b}m".format(r=ir, g=ig, b=ib) + ips[session] + "\x1b[0m ---")
+  for entry in entries:
+    if(entry['session'] == session):
+      if(entry['message']):
+        eventid = entry['eventid']
+        print(entry["timestamp"] + " > " + eventid + (" " * (29 - len(eventid))) + ": " + entry['message'])
+      else:
+        print(entry["timestamp"] + " > " + entry['eventid'])
+\ No newline at end of file