Content
- Log parsers2
- Attack scenarios4
- Contexts1
Cowrie Honeypot
Collection
- By
- PumbaLP
- Version
- 0.1
- Name
- PumbaLP/cowrie
Cowrie honeypot JSON logs: parser, honeypot interaction detection, SSH and telnet brute force
Installation
sudo cscli collections install PumbaLP/cowrieThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
name: PumbaLP/cowriedescription: "Cowrie honeypot JSON logs: parser, honeypot interaction detection, SSH and telnet brute force"author: PumbaLPparsers:- PumbaLP/cowrie-json-logs- crowdsecurity/dateparse-enrichscenarios:- PumbaLP/cowrie-precision- crowdsecurity/ssh-bf- crowdsecurity/ssh-slow-bf- crowdsecurity/telnet-bfcontexts:- crowdsecurity/bf_baselabels:label: "Cowrie Honeypot"tags:- security_engine- linux- honeypot- cowrie- ssh- telnet- bruteforce
Installed on
Know where it runs
Sign in to see the Security Engines that run this collection, the version they run and whether it was modified locally.
Documentation
Cowrie honeypot (JSON logs)
Support for the JSON event log of the Cowrie SSH and telnet honeypot (cowrie.json, one JSON object per line, written by Cowrie's output_jsonlog module, which is enabled by default).
Cowrie is a honeypot: no legitimate user has a reason to connect to it. Any source that logs in, runs commands or transfers files on it is acting with hostile intent, so the Cowrie scenario uses confidence: 3.
The collection contains:
| Item | Detects |
|---|---|
PumbaLP/cowrie-json-logs | Parser for cowrie.json events |
PumbaLP/cowrie-precision | Repeated logins or shell commands from one source |
crowdsecurity/ssh-bf, crowdsecurity/ssh-slow-bf | Repeated failed SSH logins and user enumeration |
crowdsecurity/telnet-bf | Repeated telnet connections |
The parser gives failed SSH logins the ssh_failed-auth log type and telnet connections the telnet_new_session log type, so the existing hub brute-force scenarios apply to Cowrie without changes.
Acquisition template
1filenames:2 - /home/cowrie/cowrie/var/log/cowrie/cowrie.json3labels:4 type: cowrie
Adjust the path to your installation. When Cowrie runs in a container, mount its var/log/cowrie directory on the host and point filenames at cowrie.json there.
Notes
- Cowrie's text log (
cowrie.logor syslog output) is handled bycrowdsecurity/cowrie-logs. Both parsers usetype: cowrieand can be installed together: each one only accepts its own format. - Cowrie 2.9.0 and later record
protocolon every event. Older releases only record it oncowrie.session.connect; with those,crowdsecurity/telnet-bfstill works, butcrowdsecurity/ssh-bfdoes not see SSH failed logins. - A bouncer on the honeypot host itself blocks attackers from reaching Cowrie and reduces what the honeypot records. Many operators run the honeypot in detection-only mode and use the resulting signals and decisions elsewhere.
- Logins you make to your own honeypot also raise alerts. Add your own addresses to a whitelist (for example an
s02-enrichwhitelist parser).