Cowrie

C tier on Honeypot SoftwareScore 6.8 · #4 of 18

Android app: Not listed
Free plan: Yes
Runs on: Linux, self-hosted

cowrie.org

Summary

Cowrie is a free, open-source SSH and Telnet honeypot for recording brute-force attempts and activity in attackers’ shell sessions. In its default mode, it imitates a UNIX environment in Python with a fake filesystem, so commands do not run on the real host. Its proxy mode instead forwards SSH and Telnet sessions to another system while monitoring behavior. Cowrie records terminal sessions with timing information for replay and saves files fetched with wget or curl, as well as files uploaded through SFTP or SCP. JSON logs can include logins, commands, downloads, TCP forwards, and session metadata. Output plugins connect to tools and services such as Elasticsearch, Splunk, Microsoft Sentinel, MISP, VirusTotal, databases, Slack, and Prometheus. An experimental LLM backend can generate shell responses while keeping session context. Cowrie is self-hosted and can be installed with pip, Docker, or a Git checkout; the documentation lists Python 3.11+ and python-virtualenv as local requirements. It is BSD-licensed, began in 2014, and is maintained by volunteers.

Who it is for

Cowrie is aimed at security researchers, CERTs, and defenders who want to observe SSH and Telnet activity. It requires self-hosting and the listed local software requirements.

What is good

Fake filesystem keeps emulated commands off the real host
Proxy mode monitors forwarded SSH and Telnet sessions
Records sessions for timed replay
Captures downloads and SFTP or SCP uploads
JSON logs and many output plugins

What to know first

Self-hosted deployment
Requires Python 3.11+ and python-virtualenv
LLM backend is experimental

Verdict

Cowrie offers a self-hosted honeypot with session capture, file collection, and multiple logging integrations. Its default emulated shell is designed to keep commands within a fake filesystem, while proxy mode monitors sessions forwarded to another system.

Cowrie plans and pricing

All plans

Cowrie Free Free and open-source SSH and Telnet honeypot · BSD licensed cowrie.org · 2 Oct 2026

Compared on honeypot software

Free plan: Yescowrie.org
Deployment model: self-hostedcowrie.org
Decoy scope: multi-layercowrie.org
Credential lures: Yescowrie.org

Facts

What it does: Cowrie is a medium- to high-interaction SSH and Telnet honeypot designed to log brute-force attacks and attackers’ shell activity.docs.cowrie.org · 2 Oct 2026
Emulated shell: Its default shell mode emulates a UNIX system in Python with a fake filesystem and does not run attackers’ commands on the real host.cowrie.org · 2 Oct 2026
Proxy mode: Proxy mode forwards SSH and Telnet sessions to another system while monitoring attacker behavior.docs.cowrie.org · 2 Oct 2026
Session recording: Cowrie records terminal sessions with timing information for later replay using its playlog utility.cowrie.org · 2 Oct 2026
Malware capture: Cowrie saves files fetched with wget or curl and files uploaded with SFTP or SCP for later inspection.docs.cowrie.org · 2 Oct 2026
Logging: Cowrie logs attacker activity as JSON, including logins, commands, downloads, TCP forwards and session metadata.cowrie.org · 2 Oct 2026
Integrations: Output plugins include Elasticsearch, Splunk, Microsoft Sentinel, MISP, VirusTotal, Slack, Discord, MySQL, PostgreSQL, SQLite, MongoDB, Graylog, Kafka, Prometheus, Datadog and Amazon S3.cowrie.org · 2 Oct 2026
LLM mode: An experimental LLM backend can generate dynamic shell responses and maintain conversation context across a session.docs.cowrie.org · 2 Oct 2026
Deployment: Cowrie can be installed using pip, Docker or a Git checkout, and its documentation lists Python 3.11+ and python-virtualenv as local requirements.docs.cowrie.org · 2 Oct 2026
Security boundary: The feature page says the emulated shell is safe to expose because commands run in a fake filesystem and do not touch the real host.cowrie.org · 2 Oct 2026
License and history: Cowrie is free and open source under a BSD license and began in 2014 as a fork of the Kippo honeypot.cowrie.org · 2 Oct 2026
Who maintains it: Cowrie is maintained by volunteers, and the project credits creator and maintainer Michel Oosterhof.cowrie.org · 2 Oct 2026
Intended users: The project says it is used by security researchers, CERTs and defenders around the world.cowrie.org · 2 Oct 2026
Support: The project links users to community Slack and Discord channels.cowrie.org · 2 Oct 2026