Cowrie

Cowrie is a free, self-hosted SSH and Telnet honeypot for security researchers, CERTs and defenders who want to observe hostile activity. Its strongest case is detailed session and file capture; operating and securing the deployment is your responsibility.

Overview

Cowrie is built to record brute-force attempts and what attackers do after connecting. Its default emulated shell presents a UNIX-like environment backed by a fake filesystem, keeping commands away from the real host. That boundary makes it suitable for exposing a decoy service, but it does not turn Cowrie into a general-purpose endpoint defense.

Proxy mode takes a different approach: it forwards SSH and Telnet sessions to another system while monitoring behavior. That offers visibility into sessions reaching a real system, but it is not the same isolation model as the emulated shell.

Key features

Session recordings preserve terminal activity with timing information, which can be replayed later with Cowrie’s playlog utility. This is useful when command order and pacing matter to an investigation, rather than relying only on a summary of events.

Cowrie captures files fetched with wget or curl and files uploaded over SFTP or SCP for later inspection. Its JSON logs cover logins, commands, downloads, TCP forwards and session metadata, giving defenders material to route into analysis and monitoring workflows.

Output plugins connect Cowrie to systems including Elasticsearch, Splunk, Microsoft Sentinel, MISP, VirusTotal, Slack, Discord, SQL and NoSQL databases, Graylog, Kafka, Prometheus, Datadog and Amazon S3. That breadth suits teams with an existing monitoring stack, though choosing and maintaining those integrations remains part of running a self-hosted tool.

An experimental LLM backend can produce dynamic shell responses and retain conversation context during a session. Its experimental status makes it an option to explore, not a reason to depend on it for a production workflow.

Pricing

Cowrie is free and open source under a BSD license. The Cowrie plan costs nothing and includes the free, BSD-licensed SSH and Telnet honeypot. There is no paid tier or feature-based plan distinction in this offering; the tradeoff is that deployment and operation are self-hosted.

Installation options include pip, Docker and a Git checkout. Local requirements include Python 3.11+ and python-virtualenv, so teams need the ability to manage a Linux environment and its dependencies rather than expecting a hosted service.

Platforms

Cowrie is for Linux and is self-hosted. It began in 2014 as a fork of the Kippo honeypot and is maintained by volunteers; the project credits creator and maintainer Michel Oosterhof. Community Slack and Discord channels provide places to seek support.

Who it's for

Cowrie is a strong fit for security researchers, CERTs and defenders who need to collect SSH or Telnet attack behavior, retain captured files and feed structured events into other tools. It is less suited to people seeking a managed honeypot, turnkey operations or a broadly supported commercial service.

Pros and cons

• Pros: The emulated shell uses a fake filesystem rather than running commands on the real host, making it a practical decoy boundary.
• Pros: Timed session replay, file capture and structured JSON logs provide complementary evidence for investigating activity.
• Pros: A wide selection of output plugins can fit Cowrie into established security and observability systems.
• Cons: Linux self-hosting and Python requirements mean teams must handle installation and ongoing operation themselves.
• Cons: Proxy mode forwards sessions to another system, so it does not provide the fake-filesystem boundary of the emulated shell.
• Cons: The LLM backend is experimental and should not be treated as a dependable core capability.

Alternatives

For another free, self-hosted option, Beelzebub offers an open-source core framework across API, Linux and self-hosted platforms, and includes a free trial.

T-Pot is also free and open source, with Linux, macOS, Windows and self-hosted support; choose it if those platform options matter, while accounting for its hardware and network requirements.

Canarytokens is a free alternative with a hosted service whose tokens are free, as well as Android, iOS, web, Windows and self-hosted platforms.

OpenCanary is another free, open-source, self-hosted option for Linux or macOS.

Thinkst Canary is a paid choice at $7,500 a year for five canaries, with hardware, virtual, cloud or container deployment options.

CounterCraft The Platform is a paid, self-hosted and web option with custom pricing based on environment size, deployment scope and use case.

DentiGrid is a paid API, self-hosted and web option with commercial licensing for MSSPs and enterprises.

Heralding is a free, GPL-3.0-licensed open-source honeypot for Linux and self-hosted deployment.

Browse more options in Honeypot Software.

Verdict

Choose Cowrie if you want a free Linux honeypot that captures SSH and Telnet sessions, downloaded or uploaded files, and structured activity for your own security workflow. Its fake-filesystem shell and broad integrations are compelling strengths; look elsewhere if you need managed hosting, commercial support or a platform that does not require self-hosting.