GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • cowrie
  • Cowrie
  • Installing Cowrie
  • Frequently asked questions
  • Changing the Cowrie file system
  • Using the Proxy
  • Backend Pool
  • Analyzing snapshots and downloaded content
  • Using the LLM Backend
  • Docker Repository
  • Automatically starting Cowrie with systemd
  • Automatically starting Cowrie with supervisord
  • Using TCP tunneling with Squid
  • How to send Cowrie output to an ELK stack

This view

  • Original page
  • New address

GeezerVison is showing docs.cowrie.org — Welcome to Cowrie’s documentation! — cowrie 3.1.7.dev5+ga4237125e documentation

Welcome to Cowrie’s documentation!

Getting started

  • Cowrie
    • What is Cowrie
    • Documentation
    • Slack
    • Features
    • Installation
    • Docker
    • PyPI
    • Requirements
    • Files of interest:
    • Commands
    • Contributors
  • Installing Cowrie
    • Contents
    • Quick start: pip install
    • Pip install (operators)
    • Source checkout (developers)
    • Iptables
    • Authbind
    • Setcap
    • cowrie is not initialized in this directory
    • CryptographyDeprecationWarning: Blowfish has been deprecated
    • twistd: unknown command: cowrie
    • General approach
    • Per-file operator override
    • Editing the pickle
    • Rebuilding the pickle from scratch
  • Frequently asked questions
    • Do I need to copy all the content of cowrie.cfg.dist to cowrie.cfg?
    • Why aren’t certain commands implemented?
    • How do I add or modify the default user?
    • How do I add files to the file system?

Configuring the honeypot

  • Changing the Cowrie file system
    • Introduction
    • Creating a new pickle file
    • Customizing text command output
  • Using the Proxy
    • Choosing a Backend
    • Configuring the Proxy
  • Backend Pool
    • Authorization
    • Guest images
    • Backend Pool initialization
    • Proxy configurations
    • Backend Pool configuration
    • Creating VM images
    • References
  • Analyzing snapshots and downloaded content
    • Getting a filesystem diff
    • Getting interesting files
  • Using the LLM Backend
    • Enabling the LLM Backend
    • Configuration
    • How It Works
    • Advantages
    • Limitations
    • Security Considerations
    • Example Configuration

Deployment

  • Docker Repository
    • Docker Quick Start
    • Configuring Cowrie in Docker with Environment Variables
    • Configuring Cowrie in Docker with Config Files
    • Building Docker Images
  • Automatically starting Cowrie with systemd
  • Automatically starting Cowrie with supervisord
  • Using TCP tunneling with Squid
    • Squid Prerequisites
    • Squid Installation
    • Squid Configuration
    • Cowrie Configuration for Squid
    • Restart Cowrie

Output integrations

  • How to send Cowrie output to Datadog Log Management
    • Datadog output module Prerequisites
    • Cowrie Configuration for Datadog output module
    • Datadog Configuration
  • How to send Cowrie output to an ELK stack
    • ELK Prerequisites
    • Installing the Elastic Stack
    • ElasticSearch Configuration
    • Kibana Configuration
    • Logstash Configuration
    • FileBeat Configuration
    • Nginx
    • Using Kibana
    • Tuning the ELK stack
    • ElasticSearch Troubleshooting
  • How to send Cowrie output to Graylog
    • Prerequisites
    • Cowrie Configuration
    • Graylog Configuration
    • Syslog Configuration (For Syslog Output only)
  • How to Send Cowrie Output to Prometheus
  • 1. Create the Docker network
  • 2. Prepare the Prometheus volume and configuration
  • 3. Launch Prometheus on cowrie-net
  • 4. Run Cowrie with Prometheus metrics
  • 5. Run node-exporter (host metrics)
  • 6. Run cAdvisor (container metrics)
  • Run cowrie with prometheus locally
  • How to send Cowrie output to Azure Sentinel
  • How to send Cowrie output to Splunk
    • Splunk Output Module
    • File Based
    • Reporting
  • How to Send Cowrie output to a MySQL or PostgreSQL Database
    • MySQL/PostgreSQL Output Plugin Prerequisites
    • MySQL Installation
    • MySQL Configuration
    • Cowrie Configuration for MySQL
    • Confirm That Events are Logged to the MySQL Database
    • PostgreSQL Installation
    • PostgreSQL Configuration
    • PostgreSQL Schema Update for Boolean Compatibility
    • Cowrie Configuration for PostgreSQL
    • Verify That the PostgreSQL Output Engine Has Been Loaded
    • Confirm That Events are Logged to the PostgreSQL Database
  • VirusTotal Integration
    • Overview
    • Features
    • Prerequisites
    • Configuration
    • Configuration Options
    • Output Events
    • Example Output
    • Collections
    • Best Practices
    • Troubleshooting
    • API Reference
    • Contributing
    • License
    • Support

Reference

  • Output Event Code Reference
    • Shared Attributes
    • Reference
  • Event Pipeline Design
    • Terminology
    • Two streams
    • Architecture
    • Calling patterns
    • Operational considerations
    • Security considerations
    • Testing
    • Diagnostics on twisted.logger

Project

  • Contributing Guidelines
    • Reporting Bugs/Feature Requests
    • Contributing via Pull Requests
    • Finding contributions to work on
    • Licensing
  • Release Notes
    • Unreleased
    • Release 3.1.5 (2026-10-31)
    • Release 3.1.4 (2026-10-24)
    • Release 3.1.3 (2026-10-15)
    • Release 3.1.2 (2026-10-12)
    • Release 3.1.1 (2026-10-03)
    • Release 3.1.0 (2026-10-02)
    • Release 3.0.15 (2026-09-19)
    • Release 3.0.14 (2026-09-07)
    • Release 3.0.13 (2026-08-23)
    • Release 3.0.12 (2026-08-04)
    • Release 3.0.11 (2026-07-31)
    • Release 3.0.10 (2026-07-26)
    • Release 3.0.9 (2026-07-23)
    • Release 3.0.8 (2026-07-20)
    • Release 3.0.7 (2026-07-20)
    • Release 3.0.6 (2026-07-11)
    • Release 3.0.5 (2026-06-27)
    • Release 3.0.4 (2026-06-22)
    • Release 3.0.3 (2026-06-08)
    • Release 3.0.2 (2026-06-04)
    • Release 3.0.1 (2026-05-31)
    • Release 3.0.0
    • Releases 2.9.1 – 2.9.20
    • Release 2.9.0
    • Release 2.7.0
    • Release 2.6.0
    • Release 2.5.0
    • Release 2.4.0
    • Release 2.3.0
    • Release 2.2.0
    • Release 2.1.0
    • Release 2.0.1
    • Release 2.0.0
    • Release 1.6.0
    • Release 1.5.3
    • Release 1.5.2
    • Release 1.5.1
  • LICENSE

Indices and tables

  • Index

  • Module Index

  • Search Page

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.