Welcome to Cowrie’s documentation!

Getting started

• Cowrie
  • What is Cowrie
  • Documentation
  • Slack
  • Features
  • Installation
  • Docker
  • PyPI
  • Requirements
  • Files of interest:
  • Commands
  • Contributors
• Installing Cowrie
  • Contents
  • Quick start: pip install
  • Pip install (operators)
  • Source checkout (developers)
  • Iptables
  • Authbind
  • Setcap
  • cowrie is not initialized in this directory
  • CryptographyDeprecationWarning: Blowfish has been deprecated
  • twistd: unknown command: cowrie
  • General approach
  • Per-file operator override
  • Editing the pickle
  • Rebuilding the pickle from scratch
• Frequently asked questions
  • Do I need to copy all the content of cowrie.cfg.dist to cowrie.cfg?
  • Why aren’t certain commands implemented?
  • How do I add or modify the default user?
  • How do I add files to the file system?

Configuring the honeypot

• Changing the Cowrie file system
  • Introduction
  • Creating a new pickle file
  • Customizing text command output
• Using the Proxy
  • Choosing a Backend
  • Configuring the Proxy
• Backend Pool
  • Authorization
  • Guest images
  • Backend Pool initialization
  • Proxy configurations
  • Backend Pool configuration
  • Creating VM images
  • References
• Analyzing snapshots and downloaded content
  • Getting a filesystem diff
  • Getting interesting files
• Using the LLM Backend
  • Enabling the LLM Backend
  • Configuration
  • How It Works
  • Advantages
  • Limitations
  • Security Considerations
  • Example Configuration

Deployment

• Docker Repository
  • Docker Quick Start
  • Configuring Cowrie in Docker with Environment Variables
  • Configuring Cowrie in Docker with Config Files
  • Building Docker Images
• Automatically starting Cowrie with systemd
• Automatically starting Cowrie with supervisord
• Using TCP tunneling with Squid
  • Squid Prerequisites
  • Squid Installation
  • Squid Configuration
  • Cowrie Configuration for Squid
  • Restart Cowrie

Output integrations

• How to send Cowrie output to Datadog Log Management
  • Datadog output module Prerequisites
  • Cowrie Configuration for Datadog output module
  • Datadog Configuration
• How to send Cowrie output to an ELK stack
  • ELK Prerequisites
  • Installing the Elastic Stack
  • ElasticSearch Configuration
  • Kibana Configuration
  • Logstash Configuration
  • FileBeat Configuration
  • Nginx
  • Using Kibana
  • Tuning the ELK stack
  • ElasticSearch Troubleshooting
• How to send Cowrie output to Graylog
  • Prerequisites
  • Cowrie Configuration
  • Graylog Configuration
  • Syslog Configuration (For Syslog Output only)
• How to Send Cowrie Output to Prometheus
• 1. Create the Docker network
• 2. Prepare the Prometheus volume and configuration
• 3. Launch Prometheus on cowrie-net
• 4. Run Cowrie with Prometheus metrics
• 5. Run node-exporter (host metrics)
• 6. Run cAdvisor (container metrics)
• Run cowrie with prometheus locally
• How to send Cowrie output to Azure Sentinel
• How to send Cowrie output to Splunk
  • Splunk Output Module
  • File Based
  • Reporting
• How to Send Cowrie output to a MySQL or PostgreSQL Database
  • MySQL/PostgreSQL Output Plugin Prerequisites
  • MySQL Installation
  • MySQL Configuration
  • Cowrie Configuration for MySQL
  • Confirm That Events are Logged to the MySQL Database
  • PostgreSQL Installation
  • PostgreSQL Configuration
  • PostgreSQL Schema Update for Boolean Compatibility
  • Cowrie Configuration for PostgreSQL
  • Verify That the PostgreSQL Output Engine Has Been Loaded
  • Confirm That Events are Logged to the PostgreSQL Database
• VirusTotal Integration
  • Overview
  • Features
  • Prerequisites
  • Configuration
  • Configuration Options
  • Output Events
  • Example Output
  • Collections
  • Best Practices
  • Troubleshooting
  • API Reference
  • Contributing
  • License
  • Support

Reference

• Output Event Code Reference
  • Shared Attributes
  • Reference
• Event Pipeline Design
  • Terminology
  • Two streams
  • Architecture
  • Calling patterns
  • Operational considerations
  • Security considerations
  • Testing
  • Diagnostics on twisted.logger

Project

• Contributing Guidelines
  • Reporting Bugs/Feature Requests
  • Contributing via Pull Requests
  • Finding contributions to work on
  • Licensing
• Release Notes
  • Unreleased
  • Release 3.1.5 (2026-10-31)
  • Release 3.1.4 (2026-10-24)
  • Release 3.1.3 (2026-10-15)
  • Release 3.1.2 (2026-10-12)
  • Release 3.1.1 (2026-10-03)
  • Release 3.1.0 (2026-10-02)
  • Release 3.0.15 (2026-09-19)
  • Release 3.0.14 (2026-09-07)
  • Release 3.0.13 (2026-08-23)
  • Release 3.0.12 (2026-08-04)
  • Release 3.0.11 (2026-07-31)
  • Release 3.0.10 (2026-07-26)
  • Release 3.0.9 (2026-07-23)
  • Release 3.0.8 (2026-07-20)
  • Release 3.0.7 (2026-07-20)
  • Release 3.0.6 (2026-07-11)
  • Release 3.0.5 (2026-06-27)
  • Release 3.0.4 (2026-06-22)
  • Release 3.0.3 (2026-06-08)
  • Release 3.0.2 (2026-06-04)
  • Release 3.0.1 (2026-05-31)
  • Release 3.0.0
  • Releases 2.9.1 – 2.9.20
  • Release 2.9.0
  • Release 2.7.0
  • Release 2.6.0
  • Release 2.5.0
  • Release 2.4.0
  • Release 2.3.0
  • Release 2.2.0
  • Release 2.1.0
  • Release 2.0.1
  • Release 2.0.0
  • Release 1.6.0
  • Release 1.5.3
  • Release 1.5.2
  • Release 1.5.1
• LICENSE

Indices and tables

• Index

• Module Index

• Search Page