Cowrie

Free#2 of 21 in Honeypot Software

Cowrie: A mature, deep SSH and Telnet honeypot for self-hosted threat monitoring. Ranked #2 of 21 in Honeypot Software by our editors (9.2/10); pricing: Free plan; best for mature SSH and Telnet monitoring.

9.2/10★★★★★Editor score

Visit Cowrie

At a glance

• Editor score
  9.2 / 10
• Pricing
  Free plan
• Best for
  Mature SSH and Telnet monitoring
• Free plan
  Yes
• Paid from
  Free
• Deployment model
  Self-hosted
• Founded
  2014
• Facts checked
  22 Sep 2026

• Where it wins

  • Detailed SSH and Telnet session logging, replay, and file capture
  • Configurable Unix shell and fake filesystem for layered decoys
  • Broad integrations across SIEMs, databases, messaging, and threat intelligence

• Where it doesn't

  • Self-hosted deployment requires Linux-based operational ownership
  • Primary monitoring scope centers on SSH and Telnet activity
  • Experimental LLM backend may not suit production-critical workflows

Our verdict on Cowrie

Cowrie is an open-source SSH and Telnet honeypot for security researchers, CERTs, defenders, and other operators. It runs on Linux in self-hosted environments and emulates a Unix-like system with a configurable fake filesystem. The product records brute-force login attempts and attacker commands, captures transferred files, and produces structured JSON events. Its 2014 founding year also gives it a mature position among honeypot projects.

Cowrie’s standout strength is the depth of its SSH and Telnet monitoring. Session recording and replay through playlog can preserve attacker activity for later analysis, while file capture covers transfers through wget, curl, SFTP, and SCP. Operators can also use SSH and Telnet proxy mode with real backends, or a QEMU/libvirt backend pool for isolated virtual machines. An experimental LLM backend adds dynamic shell responses, while the emulated shell and configurable filesystem support more tailored decoy environments than a basic connection logger.

The ecosystem fit is broad for teams that already operate security monitoring infrastructure. Output plugins connect Cowrie with Elasticsearch, Splunk, Microsoft Sentinel, MISP, hpfeeds, VirusTotal, Slack, Discord, MySQL, PostgreSQL, SQLite, MongoDB, Graylog, Kafka, and Prometheus. Local Python installation and Docker deployment provide two documented deployment paths. Cowrie is a strong choice for teams that want detailed SSH and Telnet telemetry with flexible integrations and multi-layer decoys; organizations seeking a managed service or a honeypot centered on other protocols should look elsewhere.

Questions about Cowrie

What does Cowrie run on? Linux. It runs self-hosted.

What does Cowrie integrate with? 40+ integrations, including Elasticsearch, Splunk, Microsoft Sentinel, MISP and hpfeeds.

Who is Cowrie built for? Solo users, small businesses, mid-market companies and enterprises (our editorial estimate).

Your product? Our editors can test Cowrie in depth and publish a review, labelled as paid · from $149/mo →

Cowrie pricing

Cowrie fact sheet

Cowrie integrations

Cowrie lists 40+ integrations on its own site — the 20 named here are the ones its pages call out.

• Elasticsearch
• Splunk
• Microsoft Sentinel
• MISP
• hpfeeds
• VirusTotal
• Slack
• Discord
• MySQL
• PostgreSQL
• SQLite
• MongoDB
• Graylog
• Kafka
• Prometheus
• Datadog
• Amazon S3
• AbuseIPDB
• DShield
• Syslog

See all Cowrie integrations →

Alternatives to Cowrie

• BeelzebubA flexible self-hosted honeypot runtime with adaptive interactions and deep security integrations.9.4
• TPT-PotA broad self-hosted honeypot platform for teams that want many decoys and built-in analysis.9.0
• CanarytokensA free, cloud-based token platform for broad deception and intrusion detection.8.8

See all Cowrie alternatives →

Cowrie vs the competition

• Cowrie vs Beelzebub
• TPCowrie vs T-Pot
• Cowrie vs Canarytokens
• OCowrie vs OpenCanary
• Cowrie vs Thinkst Canary
• Cowrie vs CounterCraft The Platform

Compare Cowrie with any tool side by side →

Used Cowrie? Be the first to review it

The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Cowrie for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.

Write a reviewTwo minutes · verified accounts only · read by an editor before it appears

Website

Reviews come only from verified accounts. Sign in or create an account first — your e-mail is never shown.

Your rating

5 stars★4 stars★3 stars★2 stars★1 star★

Title

Your review

0 characters · at least 80, up to 3,000

Pros (optional · one per line)

Cons (optional · one per line)

Your name (shown with your review)

Role (optional)

Company (optional)

How long have you used it?Prefer not to sayLess than a month1–6 months6–12 months1–2 years2+ years

I've used Cowrie myself and this is my honest opinion — nobody paid or asked me to write it.

Send my reviewPosted from your verified account. Reviews appear after an editor reads them, usually within two working days.

Featured on iTechGuides

Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 14 Nov 2026 · How we research and update