import json import sys import random if not 0 <= 1 < len(sys.argv): print("Provide a path to a Cowrie JSON log file") exit() filepath = sys.argv[1] entries = [] sessions = [] session_ips = {} with open(filepath, "r") as logfile: for line in logfile: entry = json.loads(line) entries.append(entry) session = entry['session'] if(session not in sessions): sessions.append(session) session_ips.update({session: entry['src_ip']}) filter_ip = "" if 0 <= 2 < len(sys.argv): filter_ip = sys.argv[2] for session in sessions: ip = session_ips[session] if(ip == filter_ip or not filter_ip): random.seed(session) sr = random.randrange(50, 256) sg = random.randrange(50, 256) sb = random.randrange(50, 256) random.seed(ip) ir = random.randrange(50, 256) ig = random.randrange(50, 256) ib = random.randrange(50, 256) print("\n--- Session \x1b[38;2;{r};{g};{b}m".format(r=sr, g=sg, b=sb) + session + "\x1b[0m from \x1b[38;2;{r};{g};{b}m".format(r=ir, g=ig, b=ib) + session_ips[session] + "\x1b[0m ---") for entry in entries: if(entry['session'] == session): if(entry['message']): eventid = entry['eventid'] print(entry["timestamp"] + " > " + eventid + (" " * (29 - len(eventid))) + ": " + entry['message']) else: print(entry["timestamp"] + " > " + entry['eventid'])