Skip to content

Instantly share code, notes, and snippets.

@jatrost
Created January 12, 2016 00:39
Show Gist options
  • Star 2 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save jatrost/15869059f1e6606051cc to your computer and use it in GitHub Desktop.
Save jatrost/15869059f1e6606051cc to your computer and use it in GitHub Desktop.
#!/bin/bash
PAST_TIMESTAMP="$(date +%s -d '5 min ago')000"
mongoexport \
--csv --quiet \
--fields timestamp,source_ip,source_port,destination_port,honeypot \
--db mnemosyne \
--collection session \
--query "{ timestamp: {\$gt: new Date($PAST_TIMESTAMP)}}" > /tmp/mhn-report.txt
(
echo -e "MHN Hits in the last 5 minutes:\n" ;
/tmp/mhn-report.txt
) | mailx -s "MHN Report: $(date -d '5 min ago')" some-email-address@my-company.com
@hilbas
Copy link

hilbas commented Oct 17, 2019

this script works for dionaea?

@heewey
Copy link

heewey commented Apr 21, 2021

Thanks for the script!!

For some unexpected reason this script does not work for me, then I modified it to use mongo shell directly from bash.

#!/bin/bash
DB="mnemosyne"
PAST_TIMESTAMP="$(date +%s -d '5 min ago')000"
mongo "$DB" --quiet --eval "db.session.find({"timestamp" : { $gt : new Date ("$PAST_TIMESTAMP")}},{ "source_ip" : 1, "source_port" :1,
"destination_ip" :1, "destination_port" :1, "honeypot" :1, "_id" : 0})" > /tmp/mhn-report.txt
...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment