cowrie-json-logs Log Parser by PumbaLP

Installation

sudo cscli parsers install PumbaLP/cowrie-json-logs

Then reload CrowdSec: sudo systemctl reload crowdsec

Sign in to see which of your engines run it →

Configuration

Hover a line or a note to see what each field does.

parsers/s01-parse/PumbaLP/cowrie-json-logs.yaml· 41 linesGitHub

1onsuccess: next_stage1
2name: PumbaLP/cowrie-json-logs
3description: "Parse Cowrie honeypot JSON logs (cowrie.json)"
4# The line is decoded once into evt.Unmarshaled.cowrie. Lines that are not a
5# JSON object (for example Cowrie text logs, handled by crowdsecurity/cowrie-logs)
6# are skipped before decoding.
7filter: >-2
8  evt.Parsed.program == 'cowrie' &&
9  evt.Parsed.message startsWith '{' &&
10  UnmarshalJSON(evt.Parsed.message, evt.Unmarshaled, 'cowrie') in ['', nil] &&
11  (evt.Unmarshaled.cowrie.eventid ?? '') startsWith 'cowrie.' &&
12  (evt.Unmarshaled.cowrie.src_ip ?? '') != ''
13statics:3
14  - target: evt.StrTime
15    expression: evt.Unmarshaled.cowrie.timestamp
16  # Cowrie writes "%Y-%m-%dT%H:%M:%S.%fZ" (TZ=UTC) or "%Y-%m-%dT%H:%M:%S.%f%z"
17  - target: evt.StrTimeFormat
18    value: "2006-01-02T15:04:05Z0700"
19  - meta: source_ip
20    expression: evt.Unmarshaled.cowrie.src_ip
21  - meta: dest_ip
22    expression: evt.Unmarshaled.cowrie.dst_ip
23  - meta: dest_port
24    expression: "evt.Unmarshaled.cowrie.dst_port != nil ? string(int(evt.Unmarshaled.cowrie.dst_port)) : nil"
25  - meta: target_user
26    expression: evt.Unmarshaled.cowrie.username
27  # Cowrie >= 2.9.0 sets "protocol" on every event; older releases only on cowrie.session.connect
28  - meta: service
29    expression: "evt.Unmarshaled.cowrie.protocol in ['ssh', 'telnet'] ? evt.Unmarshaled.cowrie.protocol : 'cowrie'"
30  # Telnet connections and SSH failed logins reuse the log_type of the hub
31  # telnet/sshd parsers so crowdsecurity/telnet-bf and crowdsecurity/ssh-bf apply.
32  # Every other event becomes cowrie_<eventid suffix>, e.g. cowrie_command_input.
33  # A file_download without a URL is a file written by shell redirection.
34  - meta: log_type
35    expression: |
36      let eventid = evt.Unmarshaled.cowrie.eventid;
37      let protocol = evt.Unmarshaled.cowrie.protocol ?? '';
38      eventid == 'cowrie.session.connect' && protocol == 'telnet' ? 'telnet_new_session' :
39      eventid == 'cowrie.login.failed' && protocol == 'ssh' ? 'ssh_failed-auth' :
40      eventid == 'cowrie.session.file_download' && (evt.Unmarshaled.cowrie.url ?? '') == '' ? 'cowrie_session_file_redirect' :

Documentation

Cowrie JSON log parser

Parses the JSON event log of the Cowrie SSH and telnet honeypot (cowrie.json, one JSON object per line). Each line is decoded once into evt.Unmarshaled.cowrie, so every Cowrie field (for example input, url, shasum, hassh) is available to scenarios and alert contexts.

Lines that are not a JSON object with a cowrie.* eventid and a src_ip are ignored, so the parser can share type: cowrie with crowdsecurity/cowrie-logs, which parses Cowrie's text log.

Fields set

Meta	Source
`source_ip`	`src_ip`
`dest_ip`, `dest_port`	`dst_ip`, `dst_port`
`target_user`	`username` (login events)
`service`	`protocol` (`ssh` or `telnet`), `cowrie` when absent
`log_type`	see below

The event time is taken from timestamp (UTC ...Z or local ...+hhmm format).

Log types

Cowrie event	`log_type`
`cowrie.session.connect` over telnet	`telnet_new_session` (as `crowdsecurity/cowrie-logs`, used by `crowdsecurity/telnet-bf`)
`cowrie.login.failed` over SSH	`ssh_failed-auth` (as `crowdsecurity/sshd-logs`, used by `crowdsecurity/ssh-bf` and `crowdsecurity/ssh-slow-bf`)
`cowrie.session.file_download` without a `url` (file written by shell redirection)	`cowrie_session_file_redirect`
any other `cowrie.<a>.<b>` event	`cowrie_<a>_<b>`, e.g. `cowrie_login_success`, `cowrie_login_failed`, `cowrie_command_input`, `cowrie_session_file_download`, `cowrie_session_file_download_failed`, `cowrie_session_file_upload`

Cowrie 2.9.0 and later record protocol on every event. With older releases only cowrie.session.connect carries it, and other events get service: cowrie.

Acquisition template

1filenames:
2  - /home/cowrie/cowrie/var/log/cowrie/cowrie.json
3labels:
4  type: cowrie

cowrie-json-logs