Script to help make sense of log output from popular SSH honeypot [Cowrie](https://github.com/cowrie/cowrie/). I think I got carried away with the specialized filtering settings. Only tested on my setup. Untested with Telnet. YMMV

# Usage

```
cowrieder.py <args> filepath
```

Options:

```
-h, --help            show this help message and exit
-v, --verbose         Make the output more verbose (print abridged logs for all logins where commands are run, not just the interesting ones)
-V, --verboser        Make the output even more verbose (print timestamp, event id, and message (if applicable) for all events)
-W, --verbosest       Make the output even more verboserer (just group the input log by session id and dump it to pretty-printed JSON)
-P, --pings           Include only connections where no authentication attempt was made
-F, --fails           Include only failed logins
-L, --logins          Include only successful logins where no commands were run
-C, --commands        Include only logins where only this list of basic test commands were run: ['uname', 'nproc', 'echo']
-E, --eventful        Include only the cool interesting sessions that aren't any of that other stuff
-r, --redact-ip       Redact IP addresses by converting them to 16-character hashes
-i, --filter-ip FILTER_IP
                      Filter data to a specific IP or censored hash thereof
```