CyberCLI
Sign in →
← All connectors

Cowrie

Free · OSS

Deception

A fake SSH box that records every move an intruder makes — zero false positives.

Cowrie homepage ↗

Interactive SSH/Telnet honeypot. Records full attacker sessions — every credential they try, every command they run. Combine with OpenCanary for layered deception.

CyberCLI pack v1.0.0 preview
updated 2026-06-06

Code complete and exposed in the dashboard, but rough edges remain. Do not pin compliance claims to this pack.

What it watches

  • Any login attempt — every credential tried
  • Full command-by-command session capture
  • Files the attacker uploads or downloads (+ hashes)
  • Source IP + SSH-client fingerprint
  • Post-login behavior — recon, persistence attempts

MITRE ATT&CK coverage

Tactics this connector gives CyberCLI visibility into.

TA0001 · Initial Access TA0007 · Discovery TA0008 · Lateral Movement
See the full coverage matrix →

Every alert this connector surfaces

3 event types

Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix. The right column shows the operator-friendly phrase the dashboard renders. High-severity AI-lane signals are summarized in What it watches above (Warden + Herald handle those); the rest take the substrate's passthrough lane (no AI tokens burned).

event_type dashboard renders
cowrie.log.open Honeypot interaction on cowrie
cowrie.client.size Honeypot interaction on cowrie
cowrie.session.connect Honeypot interaction on cowrie

What it helps you catch

Any hit is a high-confidence intruder — nobody legitimate touches a honeypot, so there's nothing to false-positive.
Hands you the attacker's exact playbook: the creds they tried, the commands they ran, the payloads they pulled.
Generates fresh IOCs (IPs, hashes, creds) to block across the rest of your stack.

What you'd see in CyberCLI

illustrative
CYCON 3 high Cowrie

Honeypot SSH login + recon — high-confidence intruder

src_ip
185.220.101.7
user
root
password
admin123
commands
uname -a; wget hxxp://…/x

Routed to Warden (triage) → Knight (detection) → Scribe (record)

Suggested Block source IP · share IOC (auto at L4)

⛓ every step hash-chained · replayable

What CyberCLI reads from Cowrie

audit our math
Fields normalized
53
parsed from the source event
Event categories
—
with on-disk fixtures
Trust Ladder
L0 → L3
AI authorization range

Cowrie streams one NDJSON object per honeypot interaction — every connect, credential tried, command typed, file pulled. The 53 fields we read carry the full session: who connected (src_ip, client_version_string, HASSH + KEX fingerprints, pubkey), what they tried (attempted_username/password), what they typed (command_input/output), what they staged (download_url, download_sha256, upload_filename), plus session_id and lifecycle_role that stitch it together. TTY-recording pointers + VirusTotal enrichment land on the same event. Every hit is a high-confidence intruder by construction.

Full field index · 53 fields ↓
.action.agent_name.attempted_password.attempted_username.client_arch.client_env_name.client_env_value.client_hassh_algorithms.client_kex_algorithms.client_kex_keyalgs.client_pubkey.client_pubkey_fingerprint.client_pubkey_type.client_ssh_hassh.client_term_height.client_term_width.client_version_string.command_input.command_output.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_wire_format.download_local_path.download_sha256.download_url.dst_ip.dst_port.duration_sec.event_id.event_subtype.event_timestamp.event_type.eventid.host_id.message_text.protocol.rule_level.session_id.session_lifecycle_role.src_ip.src_port.ttylog_duplicate.ttylog_path.ttylog_sha256.ttylog_size.tunnel_dst_ip.tunnel_dst_port.upload_filename.vt_is_new.vt_positives.vt_sha256.vt_total

MITRE techniques typically mapped

Trust Ladder ceiling · L0 → L3

AI can authorize
  • ·L0–L2: digest every session hit, notify Herald on novel credentials or fetched payloads, summarize the command transcript for the operator
  • ·L3 (Knight verification): reputation lookup on src_ip + HASSH, VirusTotal pivot on download_sha256, correlate session_id with downstream flows on UniFi/Suricata — read-only
  • ·High autonomy on triage + enrichment — blast radius is zero, the honeypot is the target
Requires human approval
  • ·L4+: containment — Cowrie has no production surface to block on; src_ip blocks route through UniFi or the firewall connector, which the operator owns
  • ·Decision to expose, retire, or rotate the honeypot itself — deception strategy stays operator-owned

Full ladder semantics · /trust →

Field count + sample event auto-derived from src/cybercli/connectors/cowrie/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.

Close more of the kill chain

Cowrie covers 3 of 14 ATT&CK tactics. Pair it with these to widen coverage:

CrowdStrike Pro

+9 new tactics

SentinelOne Pro

+9 new tactics

Wazuh

+8 new tactics

How to connect

  1. 1 Deploy Cowrie on an isolated host + redirect a honeypot SSH port to it.
  2. 2 Enable JSON logging.
  3. 3 Run `cybercli onboard cowrie` and point it at the log.
  4. 4 Confirm session events in the dashboard's Connectors panel.
Install / activate
git clone https://github.com/cowrie/cowrie && cd cowrie && python3 -m venv cowrie-env && source cowrie-env/bin/activate && pip install -r requirements.txt
Guild roles it feeds
  • Warden (triage)
  • Knight (detection)
  • Scribe (record)
The Guild →
Sovereignty

Fully local. Cowrie runs on your hardware; the attacker never reaches a real system and nothing leaves your network.

Go deeper

CYCON
Live posture →
The Guild
Meet the agents →
Trust
How the leash works →
Pricing
Free vs Pro →
Install free → Browse all connectors