Repository: cowrie/cowrie

Issue:
Bug in csirtg plugin
@wesyoung Not sure when this bug started, but just looked today at my honeypots and saw this happening all over the place in the logs.

```
2018-02-11T16:53:14-0500 [twisted.internet.defer#critical] Unhandled error in Deferred:
2018-02-11T16:53:14-0500 [twisted.internet.defer#critical]
	Traceback (most recent call last):
	  File "/usr/local/lib/python2.7/dist-packages/twisted/internet/tcp.py", line 289, in connectionLost
	    protocol.connectionLost(reason)
	  File "/usr/local/lib/python2.7/dist-packages/twisted/web/client.py", line 223, in connectionLost
	    self.factory._disconnectedDeferred.callback(None)
	  File "/usr/local/lib/python2.7/dist-packages/twisted/internet/defer.py", line 459, in callback
	    self._startRunCallbacks(result)
	  File "/usr/local/lib/python2.7/dist-packages/twisted/internet/defer.py", line 567, in _startRunCallbacks
	    self._runCallbacks()
	--- <exception caught here> ---
	  File "/usr/local/lib/python2.7/dist-packages/twisted/internet/defer.py", line 653, in _runCallbacks
	    current.result = callback(current.result, *args, **kw)
	  File "/home/cowrie/cowrie/cowrie/commands/wget.py", line 241, in error
	    url=self.url)
	  File "/home/cowrie/cowrie/cowrie/shell/protocol.py", line 80, in logDispatch
	    pt.factory.logDispatch(*msg, **args)
	  File "/home/cowrie/cowrie/cowrie/telnet/transport.py", line 43, in logDispatch
	    output.logDispatch(*msg, **args)
	  File "/home/cowrie/cowrie/cowrie/core/output.py", line 117, in logDispatch
	    self.emit(ev)
	  File "/home/cowrie/cowrie/cowrie/core/output.py", line 206, in emit
	    self.write(ev)
	  File "/home/cowrie/cowrie/cowrie/output/csirtg.py", line 43, in write
	    system = e['system']
	exceptions.KeyError: 'system'
```


Discussion:
Which log message generate this? A particular one or all of them?
cowrie.log is where i'm seeing the error, don't see the same in cowrie.json
Ok! The plugin can take multiple types of messages (new connection, new download, etc). Do yo see the error with all messages or only a particular one?
i'm guessing if you add:

```python
from pprint import pprint
pprint(e)
```
https://github.com/micheloosterhof/cowrie/blob/master/cowrie/output/csirtg.py#L43

it'll show what the log message looks like, and if you change:

```
e['system']
```

to

```
e.get('system')
```

that error will resolve itself (at-least as a work-around).

by skimming it- it looks like some new message types have been added (or the 'system' keyword was changed to something else?)
@micheloosterhof Tried testing this and doesn't have any issue but the best practice would be to use the `.get()` to get the values (https://docs.quantifiedcode.com/python-anti-patterns/correctness/not_using_get_to_return_a_default_value_from_a_dictionary.html)

If you think using get would be good then I'll make a PR and if not then you can just close the issue because I didn't had kind of problem with this.
I think the issue is that there are sometimes log entries without the `system` field, they show up like so in cowrie.log:

`2019-03-14T06:18:37.755918Z [Uninitialized] connected to 127.0.0.1:8443`

the CSIRTG plugin will have issues with this format. 

The other output plugins seem to work without needing to access `system`, so it could probably be rewritten in a different way.

M.
@micheloosterhof Rewritten in other way meaning without having to use the `system` field or rewritten completely? 

Also if it not very important maybe we can just put it in the `try/except` for now

Resolving patch:
diff --git a/src/cowrie/output/csirtg.py b/src/cowrie/output/csirtg.py
--- a/src/cowrie/output/csirtg.py
+++ b/src/cowrie/output/csirtg.py
@@ -39,9 +39,10 @@ def stop(self):
     def write(self, e):
         peerIP = e['src_ip']
         ts = e['timestamp']
-        system = e['system']
+        system = e.get('system', None)
 
-        if system not in ['cowrie.ssh.factory.CowrieSSHFactory', 'cowrie.telnet.transport.HoneyPotTelnetFactory']:
+        if system not in ['cowrie.ssh.factory.CowrieSSHFactory',
+                          'cowrie.telnet.transport.HoneyPotTelnetFactory']:
             return
 
         today = str(datetime.now().date())


Test patch: