From d71a4a6b8bb7773cef59e4dd7cb7327c68c68f2f Mon Sep 17 00:00:00 2001 From: Ada Isopods Date: Wed, 21 May 2025 23:19:25 -0600 Subject: filter by sensor --- cowrieder.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'cowrieder.py') diff --git a/cowrieder.py b/cowrieder.py index 5b7550f..79abfb6 100644 --- a/cowrieder.py +++ b/cowrieder.py @@ -38,6 +38,7 @@ parser.add_argument('-r', '--redact-ip', action='store_true', help='Redact IP ad parser.add_argument('-i', '--filter-ip', help='Filter data to a specific IP, censored hash thereof, or netmask (127.0.0.1 / 0b39f7265d91e7c3 / 127.0.0.0/16)') parser.add_argument('-u', '--filter-username', help='Filter data to uses of a specific username') parser.add_argument('-p', '--filter-password', help='Filter data to uses of a specific password. Pass "'+pubkey_attempt_str+'" to filter for attempts to log in using an SSH public key instead of a password, which does happen') +parser.add_argument('-z', '--filter-sensor', help='Filter data to a certain \"sensor\". Useful if Cowrie is running in proxy mode to multiple endpoints') parser.add_argument('-c', '--no-color', action='store_true', help="Don't color-code terminal output") @@ -195,7 +196,8 @@ def load_json_to_array(fp): entry = json.loads(line) if( - (not args.filter_ip or hashgen(entry['src_ip']) == args.filter_ip or ipaddress.ip_address(entry['src_ip']) in ipaddress.ip_network(args.filter_ip)) # If it's not the IP we're filtering for don't even bother man + (not args.filter_ip or hashgen(entry['src_ip']) == args.filter_ip or ipaddress.ip_address(entry['src_ip']) in ipaddress.ip_network(args.filter_ip)) and + (not args.filter_sensor or args.filter_sensor == entry['sensor']) # If it's not the IP/sensor we're filtering for don't even bother man ): session_id = entry['session'] -- cgit v1.2.3