Building a Honeypot with Cowrie
BLUE TEAM

Building a Honeypot with Cowrie

Abhishek MainaliAbhishek Mainali•JANUARY 22, 2026•9 min read

Why Deploy a Honeypot?

Honeypots are deceptive systems designed to lure attackers and log their activities without exposing production assets. They serve as an early warning mechanism, alerting security teams to new exploit techniques or targeted brute-force campaigns.

The easiest way to orchestrate a honeypot setup safely without risking dependency clashes is to deploy via Docker containers.

Configuring Cowrie

Cowrie is a popular medium-interaction SSH and Telnet honeypot that logs brute-force attacks and shell interactions. Here's a standard `docker-compose.yml` block to quickly set up Cowrie.

docker-compose.yml
yaml
version: '3.3'
services:
  cowrie:
    image: cowrie/cowrie
    ports:
      - "2222:2222"
    volumes:
      - cowrie-var:/cowrie/cowrie-git/var
volumes:
  cowrie-var:

Parsing JSON Logs

By parsing Cowrie's extensive JSON logs, you can identify the most frequently used credential combinations and malicious IP subnets. We can write a quick python script to extract the top attacking IP addresses.

parse_ips.py
python
import json
from collections import Counter

ips = []
with open('cowrie.json', 'r') as f:
    for line in f:
        data = json.loads(line)
        if data.get('eventid') == 'cowrie.session.connect':
            ips.append(data.get('src_ip'))

print(Counter(ips).most_common(5))

Classifications

#honeypot#cowrie#docker#threat-intel

Related Intelligence

Getting Started with Penetration Testing

Getting Started with Penetration Testing

MARCH 15, 2026

Understanding Active Directory Attacks

Understanding Active Directory Attacks

FEBRUARY 10, 2026

root@abhishek:~$ cat post_end.txt

// Thanks for reading. Connection terminated.

Building a Honeypot with Cowrie | Abhishek Mainali