From d71a4a6b8bb7773cef59e4dd7cb7327c68c68f2f Mon Sep 17 00:00:00 2001 From: Ada Isopods Date: Wed, 21 May 2025 23:19:25 -0600 Subject: filter by sensor --- README.md | 6 ++++++ cowrieder.py | 4 +++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 7ed118b..f18bf9f 100644 --- a/README.md +++ b/README.md @@ -24,6 +24,12 @@ Options: -r, --redact-ip Redact IP addresses by converting them to 16-character hashes -i, --filter-ip FILTER_IP Filter data to a specific IP, censored hash thereof, or netmask (127.0.0.1 / 0b39f7265d91e7c3 / 127.0.0.0/16) +-u, --filter-username FILTER_USERNAME + Filter data to uses of a specific username +-p, --filter-password FILTER_PASSWORD + Filter data to uses of a specific password. Pass "[SSH_PUBKEY_ATTEMPT]" to filter for attempts to log in using an SSH public key instead of a password, which does happen +-z, --filter-sensor FILTER_SENSOR + Filter data to a certain "sensor". Useful if Cowrie is running in proxy mode to multiple endpoints -c, --no-color Don't color-code terminal output -s, --stats Print aggregated statistics -S, --only-stats Print only aggregated statistics diff --git a/cowrieder.py b/cowrieder.py index 5b7550f..79abfb6 100644 --- a/cowrieder.py +++ b/cowrieder.py @@ -38,6 +38,7 @@ parser.add_argument('-r', '--redact-ip', action='store_true', help='Redact IP ad parser.add_argument('-i', '--filter-ip', help='Filter data to a specific IP, censored hash thereof, or netmask (127.0.0.1 / 0b39f7265d91e7c3 / 127.0.0.0/16)') parser.add_argument('-u', '--filter-username', help='Filter data to uses of a specific username') parser.add_argument('-p', '--filter-password', help='Filter data to uses of a specific password. Pass "'+pubkey_attempt_str+'" to filter for attempts to log in using an SSH public key instead of a password, which does happen') +parser.add_argument('-z', '--filter-sensor', help='Filter data to a certain \"sensor\". Useful if Cowrie is running in proxy mode to multiple endpoints') parser.add_argument('-c', '--no-color', action='store_true', help="Don't color-code terminal output") @@ -195,7 +196,8 @@ def load_json_to_array(fp): entry = json.loads(line) if( - (not args.filter_ip or hashgen(entry['src_ip']) == args.filter_ip or ipaddress.ip_address(entry['src_ip']) in ipaddress.ip_network(args.filter_ip)) # If it's not the IP we're filtering for don't even bother man + (not args.filter_ip or hashgen(entry['src_ip']) == args.filter_ip or ipaddress.ip_address(entry['src_ip']) in ipaddress.ip_network(args.filter_ip)) and + (not args.filter_sensor or args.filter_sensor == entry['sensor']) # If it's not the IP/sensor we're filtering for don't even bother man ): session_id = entry['session'] -- cgit v1.2.3