# Buggy code
def write(self, e):
    peerIP = e["src_ip"]
    ts = e["timestamp"]
    system = e["system"]

    if system not in [
        "cowrie.ssh.factory.CowrieSSHFactory",
        "cowrie.telnet.transport.HoneyPotTelnetFactory",
    ]:
        return

    today = str(datetime.now().date())

    if not self.context.get(today):
        self.context = {}
        self.context[today] = set()

    key = ",".join([peerIP, system])

    if key in self.context[today]:
        return

    self.context[today].add(key)

    tags = "scanner,ssh"
    port = 22
    if e["system"] == "cowrie.telnet.transport.HoneyPotTelnetFactory":
        tags = "scanner,telnet"
        port = 23

    i = {
        "user": self.user,
        "feed": self.feed,
        "indicator": peerIP,
        "portlist": port,
        "protocol": "tcp",
        "tags": tags,
        "firsttime": ts,
        "lasttime": ts,
        "description": self.description,
    }

    ret = Indicator(self.client, i).submit()
    log.msg("logged to csirtg %s " % ret["location"])


# Traceback (exceptions.KeyError)
2018-02-11T16:53:14-0500 [twisted.internet.defer#critical] Unhandled error in Deferred:
2018-02-11T16:53:14-0500 [twisted.internet.defer#critical]
Traceback (most recent call last):
File "/usr/local/lib/python2.7/dist-packages/twisted/internet/tcp.py", line 289, in connectionLost
protocol.connectionLost(reason)
File "/usr/local/lib/python2.7/dist-packages/twisted/web/client.py", line 223, in connectionLost
self.factory._disconnectedDeferred.callback(None)
File "/usr/local/lib/python2.7/dist-packages/twisted/internet/defer.py", line 459, in callback
self._startRunCallbacks(result)
File "/usr/local/lib/python2.7/dist-packages/twisted/internet/defer.py", line 567, in _startRunCallbacks
self._runCallbacks()
--- <exception caught here> ---
File "/usr/local/lib/python2.7/dist-packages/twisted/internet/defer.py", line 653, in _runCallbacks
current.result = callback(current.result, *args, **kw)
File "/home/cowrie/cowrie/cowrie/commands/wget.py", line 241, in error
url=self.url)
File "/home/cowrie/cowrie/cowrie/shell/protocol.py", line 80, in logDispatch
pt.factory.logDispatch(*msg, **args)
File "/home/cowrie/cowrie/cowrie/telnet/transport.py", line 43, in logDispatch
output.logDispatch(*msg, **args)
File "/home/cowrie/cowrie/cowrie/core/output.py", line 117, in logDispatch
self.emit(ev)
File "/home/cowrie/cowrie/cowrie/core/output.py", line 206, in emit
self.write(ev)
File "/home/cowrie/cowrie/cowrie/output/csirtg.py", line 43, in write
system = e['system']
exceptions.KeyError: 'system'

# Fixed code
def write(self, e):
    peerIP = e["src_ip"]
    ts = e["timestamp"]
    system = e.get("system", None)

    if system not in [
        "cowrie.ssh.factory.CowrieSSHFactory",
        "cowrie.telnet.transport.HoneyPotTelnetFactory",
    ]:
        return

    today = str(datetime.now().date())

    if not self.context.get(today):
        self.context = {}
        self.context[today] = set()

    key = ",".join([peerIP, system])

    if key in self.context[today]:
        return

    self.context[today].add(key)

    tags = "scanner,ssh"
    port = 22
    if e["system"] == "cowrie.telnet.transport.HoneyPotTelnetFactory":
        tags = "scanner,telnet"
        port = 23

    i = {
        "user": self.user,
        "feed": self.feed,
        "indicator": peerIP,
        "portlist": port,
        "protocol": "tcp",
        "tags": tags,
        "firsttime": ts,
        "lasttime": ts,
        "description": self.description,
    }

    ret = Indicator(self.client, i).submit()
    log.msg("logged to csirtg %s " % ret["location"])