Version: 1.2
Scripted for: Dionaea 0.6.0, but should also work for Dionaea 0.8.0
Converts the SQLite database produced by Dionaea to a JSON format suitable for the ELK stack.
The JSON log files includes details about connections, downloads, logins, SQL commands, etc.
• Python 3
• SQLite logging enabled in Dionaea
This script is meant to run every minute as a cronjob. However, it may be a little heavy to run this script the first time, so it is advised that this is done manually. This is what you should put in your crontab, it will make the script run every minute:
*/1 * * * * /usr/bin/python3 /path/to/dionaeaSqliteToJson.py
Path for the sqlite dabase file of Dionaea:
/opt/dionaea/var/dionaea/dionaea.sqlite
Path for the JSON log files produced by this script:
/opt/dionaea/var/dionaea/json
Path for the binaries captured by Dionaea (to remove HTML files):
/opt/dionaea/var/dionaea/binaries
If these paths don't correspond to your setup, change the script.