Cowrie review
A mature, deep SSH and Telnet honeypot for self-hosted threat monitoring.
Reviewed by iTechGuides Editors · Editorial team · Updated Nov 2026
Cowrie is an open-source SSH and Telnet honeypot for security researchers, CERTs, defenders, and other operators. It runs on Linux in self-hosted environments and emulates a Unix-like system with a configurable fake filesystem. The product records brute-force login attempts and attacker commands, captures transferred files, and produces structured JSON events. Its 2014 founding year also gives it a mature position among honeypot projects.
Cowrie’s standout strength is the depth of its SSH and Telnet monitoring. Session recording and replay through playlog can preserve attacker activity for later analysis, while file capture covers transfers through wget, curl, SFTP, and SCP. Operators can also use SSH and Telnet proxy mode with real backends, or a QEMU/libvirt backend pool for isolated virtual machines. An experimental LLM backend adds dynamic shell responses, while the emulated shell and configurable filesystem support more tailored decoy environments than a basic connection logger.
The ecosystem fit is broad for teams that already operate security monitoring infrastructure. Output plugins connect Cowrie with Elasticsearch, Splunk, Microsoft Sentinel, MISP, hpfeeds, VirusTotal, Slack, Discord, MySQL, PostgreSQL, SQLite, MongoDB, Graylog, Kafka, and Prometheus. Local Python installation and Docker deployment provide two documented deployment paths. Cowrie is a strong choice for teams that want detailed SSH and Telnet telemetry with flexible integrations and multi-layer decoys; organizations seeking a managed service or a honeypot centered on other protocols should look elsewhere.
Questions about Cowrie
What does Cowrie run on? Linux. It runs self-hosted.
What does Cowrie integrate with? 40+ integrations, including Elasticsearch, Splunk, Microsoft Sentinel, MISP and hpfeeds.
Who is Cowrie built for? Solo users, small businesses, mid-market companies and enterprises (our editorial estimate).
Cowrie pros and cons
- Where it wins
- Detailed SSH and Telnet session logging, replay, and file capture
- Configurable Unix shell and fake filesystem for layered decoys
- Broad integrations across SIEMs, databases, messaging, and threat intelligence
- Where it doesn't
- Self-hosted deployment requires Linux-based operational ownership
- Primary monitoring scope centers on SSH and Telnet activity
- Experimental LLM backend may not suit production-critical workflows
Cowrie fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update