[PYTHON] I tried to notify the honeypot report on LINE

Introduction

Last time I wrote an article that I tried to publish the honeypot and analyzed the honeypot, Did you actually analyze it every day after that? I haven't analyzed it. So I actually made a report tool, so I will publish it.

Created program

#About cowrie log analysis
import pandas as pd
import datetime
import gzip
import datetime
import requests
dt_now = datetime.datetime.now()
year=dt_now.year
mon=dt_now.month
day=dt_now.day
if day!=1:
    day1=day-1
elif day==1:
    if mon==1:
        mon=12
        day1=31
    elif mon==2:
        mon=mon-1
        day1=28
    elif mon==3 and mon==5 and mon==7 and mon==8 and mon==10:
        mon=mon-1
        day1=31
    else:
        mon=mon-1
        day1=30
print(mon)
print(day1)
if mon==12 and day1==31:
    year=year-1
if mon<=9:
    fname = 'cowrie.json.'+str(year)+'-0'+str(mon)+'-'+str(day1)
    if day1<=9:
        fname = 'cowrie.json.'+str(year)+'-0'+str(mon)+'-0'+str(day1)
    else:
        fname = 'cowrie.json.'+str(year)+'-0'+str(mon)+'-'+str(day1)
elif mon>=9:
    if day1<=9:
        fname = 'cowrie.json.'+str(year)+'-'+str(mon)+'-0'+str(day1)
    else:
        fname = 'cowrie.json.'+str(year)+'-'+str(mon)+'-'+str(day1)

print(fname)
access = pd.read_json(fname,lines=True)
df=pd.DataFrame(access)
df['timestamp']=pd.to_datetime(df['timestamp'])
#===========================================================#
#ID (user name) you tried to log in to
df1=df.query('eventid == "cowrie.login.failed"')
noid=df1['username'].value_counts()
noid1=df1['username'].value_counts(normalize=True)
print(noid)
print("Password frequency")
print(noid1)
#Log in successfully logged in
df2=df.query('eventid == "cowrie.login.success"')
print("Number of successful logins:"+str(len(df2)))
password=df2['password'].value_counts()
password1=df2['password'].value_counts(normalize=True)
print(password)
print("Password frequency")
print(password1)
#Login failed log
df2=df.query('eventid == "cowrie.login.failed"')
print("Number of login failures:"+str(len(df2)))
nopassword=df2['password'].value_counts()
nopassword1=df2['password'].value_counts(normalize=True)
print(nopassword)
print("Password frequency")
print(nopassword1)
#Command that was successfully executed
df3=df.query('eventid == "cowrie.command.input"')
print("Command that was successfully executed")
print(df3['input'])
#Command that failed to execute
df4=df.query('eventid == "cowrie.command.failed"')
print("Command that failed to execute")
print(df4['input'])
#Successful download
df5=df.query('eventid == "cowrie.session.file_download"')
print("Successful download")
print(df5['destfile'])
#Successful download
print("What failed to download")
df6=df.query('eventid == "cowrie.session.file_download.failed"')
print(df6['destfile'])
#===========================================================#
def message1():
    line_notify_token = ''
    line_notify_api = 'https://notify-api.line.me/api/notify'
    message = 'Send a message'
    payload = {'message': message}
    headers = {'Authorization': 'Bearer ' + line_notify_token}  
    line_notify = requests.post(line_notify_api, data=payload, headers=headers)
    print('Send message')
def message1():
    line_notify_token = ''
    line_notify_api = 'https://notify-api.line.me/api/notify'
    message = str(noid)
    payload = {'message': message}
    headers = {'Authorization': 'Bearer ' + line_notify_token}  
    line_notify = requests.post(line_notify_api, data=payload, headers=headers)
    print('ID you tried to log in to')
def message2():
    line_notify_token = ''
    line_notify_api = 'https://notify-api.line.me/api/notify'
    message = str(password)
    payload = {'message': message}
    headers = {'Authorization': 'Bearer ' + line_notify_token}  
    line_notify = requests.post(line_notify_api, data=payload, headers=headers)
    print('Log in successfully logged in')
def message3():
    line_notify_token = ''
    line_notify_api = 'https://notify-api.line.me/api/notify'
    message = str(nopassword)
    payload = {'message': message}
    headers = {'Authorization': 'Bearer ' + line_notify_token}  
    line_notify = requests.post(line_notify_api, data=payload, headers=headers)
    print('Login failed log')
def message4():
    line_notify_token = ''
    line_notify_api = 'https://notify-api.line.me/api/notify'
    message = str(df3['input'])
    payload = {'message': message}
    headers = {'Authorization': 'Bearer ' + line_notify_token}  
    line_notify = requests.post(line_notify_api, data=payload, headers=headers)
    print('Command that was successfully executed')
def message5():
    line_notify_token = ''
    line_notify_api = 'https://notify-api.line.me/api/notify'
    message = str(df4['input'])
    payload = {'message': message}
    headers = {'Authorization': 'Bearer ' + line_notify_token}  
    line_notify = requests.post(line_notify_api, data=payload, headers=headers)
    print('Command that was successfully executed')
def message6():
    line_notify_token = ''
    line_notify_api = 'https://notify-api.line.me/api/notify'
    message = str(df5['destfile'])
    payload = {'message': message}
    headers = {'Authorization': 'Bearer ' + line_notify_token}  
    line_notify = requests.post(line_notify_api, data=payload, headers=headers)
    print('Commands that were successfully downloaded')
message1()
message2()
message3()
message4()
message5()
message6()

Finally

This article is incomplete, but I will publish it as a memo for the time being. To notify LINE, change the LINE API part of line_notify_token ='LINE API' You can do it. The other thing you need is ubuntu to do the regular processing, but I will fill it out later.