cowrieder.py


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

import json
import sys
import random

if(len(sys.argv) < 2):
  print("Provide a path to a Cowrie JSON log file")
  exit()
filepath = sys.argv[1]
entries = []
sessions = []
ips = {}

with open(filepath, "r") as logfile:
  for line in logfile:
    entry = json.loads(line)
    entries.append(entry)
    session = entry['session']
    if(session not in sessions):
      sessions.append(session)
      ips.update({session: entry['src_ip']})

for session in sessions:
  ip = ips[session]
  random.seed(session)
  sr = random.randrange(50, 256)
  sg = random.randrange(50, 256)
  sb = random.randrange(50, 256)
  random.seed(ip)
  ir = random.randrange(50, 256)
  ig = random.randrange(50, 256)
  ib = random.randrange(50, 256)
  print("\n--- Session \x1b[38;2;{r};{g};{b}m".format(r=sr, g=sg, b=sb) + session + "\x1b[0m from \x1b[38;2;{r};{g};{b}m".format(r=ir, g=ig, b=ib) + ips[session] + "\x1b[0m ---")
  for entry in entries:
    if(entry['session'] == session):
      if(entry['message']):
        eventid = entry['eventid']
        print(entry["timestamp"] + " > " + eventid + (" " * (29 - len(eventid))) + ": " + entry['message'])
      else:
        print(entry["timestamp"] + " > " + entry['eventid'])