diff options
Diffstat (limited to 'cowrieder.py')
| -rw-r--r-- | cowrieder.py | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/cowrieder.py b/cowrieder.py index 5b7550f..79abfb6 100644 --- a/cowrieder.py +++ b/cowrieder.py @@ -38,6 +38,7 @@ parser.add_argument('-r', '--redact-ip', action='store_true', help='Redact IP ad parser.add_argument('-i', '--filter-ip', help='Filter data to a specific IP, censored hash thereof, or netmask (127.0.0.1 / 0b39f7265d91e7c3 / 127.0.0.0/16)') parser.add_argument('-u', '--filter-username', help='Filter data to uses of a specific username') parser.add_argument('-p', '--filter-password', help='Filter data to uses of a specific password. Pass "'+pubkey_attempt_str+'" to filter for attempts to log in using an SSH public key instead of a password, which does happen') +parser.add_argument('-z', '--filter-sensor', help='Filter data to a certain \"sensor\". Useful if Cowrie is running in proxy mode to multiple endpoints') parser.add_argument('-c', '--no-color', action='store_true', help="Don't color-code terminal output") @@ -195,7 +196,8 @@ def load_json_to_array(fp): entry = json.loads(line) if( - (not args.filter_ip or hashgen(entry['src_ip']) == args.filter_ip or ipaddress.ip_address(entry['src_ip']) in ipaddress.ip_network(args.filter_ip)) # If it's not the IP we're filtering for don't even bother man + (not args.filter_ip or hashgen(entry['src_ip']) == args.filter_ip or ipaddress.ip_address(entry['src_ip']) in ipaddress.ip_network(args.filter_ip)) and + (not args.filter_sensor or args.filter_sensor == entry['sensor']) # If it's not the IP/sensor we're filtering for don't even bother man ): session_id = entry['session'] |