import json import sys import random if(len(sys.argv) < 2): print("Provide a path to a Cowrie JSON log file") exit() filepath = sys.argv[1] entries = [] sessions = [] ips = {} with open(filepath, "r") as logfile: for line in logfile: entry = json.loads(line) entries.append(entry) session = entry['session'] if(session not in sessions): sessions.append(session) ips.update({session: entry['src_ip']}) for session in sessions: ip = ips[session] random.seed(session) sr = random.randrange(50, 256) sg = random.randrange(50, 256) sb = random.randrange(50, 256) random.seed(ip) ir = random.randrange(50, 256) ig = random.randrange(50, 256) ib = random.randrange(50, 256) print("\n--- Session \x1b[38;2;{r};{g};{b}m".format(r=sr, g=sg, b=sb) + session + "\x1b[0m from \x1b[38;2;{r};{g};{b}m".format(r=ir, g=ig, b=ib) + ips[session] + "\x1b[0m ---") for entry in entries: if(entry['session'] == session): if(entry['message']): eventid = entry['eventid'] print(entry["timestamp"] + " > " + eventid + (" " * (29 - len(eventid))) + ": " + entry['message']) else: print(entry["timestamp"] + " > " + entry['eventid'])