Repository: cowrie/cowrie

Issue:
csirtg plugin no longer working
I'm not sure exactly when this happened, but just happend to check the logs today, and noticed the csirtg plugin has some errors.

```
2017-11-02T17:05:41-0400 [cowrie.telnet.transport.HoneyPotTelnetFactory] New connection: 45.32.221.61:59776 (x.x.x.x:23) [session: TT0]
2017-11-02T17:05:41-0400 [twisted.logger._observer#critical] Temporarily disabling observer LegacyLogObserverWrapper(<bound method Output.emit of <cowrie.output.csirtg.Output object at 0x7f3a5ce9bb50>>) due to exception: [Failure instance: Traceback: <type 'exceptions.TypeError'>: string indices must be integers
	/home/cowrie/cowrie/cowrie/telnet/transport.py:218:connectionMade
	/usr/local/lib/python2.7/dist-packages/twisted/python/threadable.py:53:sync
	/usr/local/lib/python2.7/dist-packages/twisted/python/log.py:286:msg
	/usr/local/lib/python2.7/dist-packages/twisted/logger/_legacy.py:154:publishToNewObserver
	--- <exception caught here> ---
	/usr/local/lib/python2.7/dist-packages/twisted/logger/_observer.py:131:__call__
	/usr/local/lib/python2.7/dist-packages/twisted/logger/_legacy.py:93:__call__
	/home/cowrie/cowrie/cowrie/core/output.py:190:emit
	/home/cowrie/cowrie/cowrie/output/csirtg.py:82:write
	]
	Traceback (most recent call last):
	  File "/home/cowrie/cowrie/cowrie/telnet/transport.py", line 218, in connectionMade
	    session=self.transportId, sessionno='T'+str(sessionno))
	  File "/usr/local/lib/python2.7/dist-packages/twisted/python/threadable.py", line 53, in sync
	    return function(self, *args, **kwargs)
	  File "/usr/local/lib/python2.7/dist-packages/twisted/python/log.py", line 286, in msg
	    _publishNew(self._publishPublisher, actualEventDict, textFromEventDict)
	  File "/usr/local/lib/python2.7/dist-packages/twisted/logger/_legacy.py", line 154, in publishToNewObserver
	    observer(eventDict)
	--- <exception caught here> ---
	  File "/usr/local/lib/python2.7/dist-packages/twisted/logger/_observer.py", line 131, in __call__
	    observer(event)
	  File "/usr/local/lib/python2.7/dist-packages/twisted/logger/_legacy.py", line 93, in __call__
	    self.legacyObserver(event)
	  File "/home/cowrie/cowrie/cowrie/core/output.py", line 190, in emit
	    self.write(ev)
	  File "/home/cowrie/cowrie/cowrie/output/csirtg.py", line 82, in write
	    logger.info('logged to csirtg %s ' % ret['indicator']['location'])
	exceptions.TypeError: string indices must be integers
```


Discussion:
One recent change is that I merge someone else's change to the connection message, that adds the protocol support (protocol=telnet or protocol=ssh). Maybe that caused it?
i'll take a look at this..
also, fwiw this kinda just looks like a logging error, not a submission error.. 

Resolving patch:
diff --git a/cowrie/output/csirtg.py b/cowrie/output/csirtg.py
--- a/cowrie/output/csirtg.py
+++ b/cowrie/output/csirtg.py
@@ -7,8 +7,7 @@
 from datetime import datetime
 import logging
 import os
-
-logger = logging.getLogger(__name__)
+from twisted.python import log
 
 USERNAME = os.environ.get('CSIRTG_USER')
 FEED = os.environ.get('CSIRTG_FEED')
@@ -42,20 +41,17 @@ def write(self, e):
         system = e['system']
 
         if system not in ['cowrie.ssh.factory.CowrieSSHFactory', 'cowrie.telnet.transport.HoneyPotTelnetFactory']:
-            logger.debug('skipping {}'.format(system))
             return
 
         today = str(datetime.now().date())
 
         if not self.context.get(today):
-            logger.debug('resetting context for %s' % today)
             self.context = {}
             self.context[today] = set()
 
         key = ','.join([peerIP, system])
 
         if key in self.context[today]:
-            logger.debug('skipping {}'.format(key))
             return
 
         self.context[today].add(key)
@@ -79,5 +75,5 @@ def write(self, e):
         }
 
         ret = Indicator(self.client, i).submit()
-        logger.info('logged to csirtg %s ' % ret['indicator']['location'])
+        log.msg('logged to csirtg %s ' % ret['location'])
 


Test patch: