cowrie/cowrie

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

6504 stars · 1058 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Cowrie is a medium-to-high interaction SSH and Telnet honeypot that logs brute-force attacks and full attacker shell sessions, capturing uploaded malware. It can emulate a UNIX filesystem in Python, proxy connections to real backend systems, or use LLMs to generate dynamic shell responses, with output plugins for SIEM platforms.

Use cases

• detect ssh brute force attacks on my server
• capture malware samples uploaded by attackers
• record attacker shell sessions for threat analysis
• set up an ssh honeypot for threat intelligence
• feed honeypot events into splunk or elasticsearch
• study attacker behavior on telnet
• deceive and monitor attackers with a fake unix shell

When to choose

• you want to observe and log SSH/Telnet attack activity and collect malware samples
• you need threat intelligence feeds integrated with SIEM tools like Splunk, Sentinel, or Elasticsearch
• you are a security researcher or CERT deploying a widely adopted, actively maintained honeypot

When to avoid

• you need to protect a production SSH service rather than study attackers
• you require a low-resource, low-interaction sensor only
• you need a honeypot for protocols other than SSH/Telnet

Facets

application · maturity active

security logging monitoring http-server middleware security self-hosted developer-tools python self-hosted honeypot ssh telnet threat-intelligence deception malware-collection siem-integration sftp llm linux docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="cowrie/cowrie")