Honeypot Workbench
Review Cowrie and OpenCanary logs in this tab, with no uploads.
No telemetry loaded
Import a sensor log to inspect sessions, artifact references and data quality. No live sensor is hosted here.
Activity over time
UTC · current filtersSource concentration
Event countsClick a source for exact address filtering.
Or paste JSON events
UTC window, source scope & duplicate handling
Time bounds exclude undated records. Source IPs identify addresses, not people. Invalid exclusions are reported and ignored.
Background readingHoneypots explainedThreat hunting
Sessions & recorded behaviour
Session keys include sensor + session ID. Missing IDs remain ungrouped. Filtering shows only matching events within a session.
Artifact references
Reported hashes and paths are unverified references. This tool does not retrieve, execute or classify files.
| Reported SHA-256 | First URL / path (inert text) | Observations | Input records |
|---|
Event explorer
Raw credential fields and authentication messages are omitted. Commands may still contain secrets. CSV formula prefixes are escaped. Reports include input provenance, filters and analyst reviews.
| Record / UTC | Sensor / source | Event | Recorded detail |
|---|
Give every result a denominator
Compare matched runs using verified uptime. Different protocols, providers and dates can explain differences.
Enter hours per sensor for sensors with equal monitored uptime. Split unequal-uptime cohorts into separate rows. Meaningful sessions must follow the same behaviour definition in both runs.
No universal winner is inferred. Log time span is not uptime. Cost per meaningful session is not cost per validated intelligence finding.
Start with a measurable objective
Choose a goal to get a tool fit, evidence checklist and downloadable operating plan.
Evidence before observation
This is a planning checklist, not a deployment or security certification. No public exposure or infrastructure changes happen in this browser.
Progression
How it compares
Checked 2026-11-06 against real output: Cowrie at commit f1908e1 (85 JSON lines, with and without epoch_timestamp) and OpenCanary 0.9.10 (38 lines across 15 logtypes), both run on a local test host with scripted logins, commands, downloads, uploads, port forwards and service probes. Every line parsed. Event ids were checked against Cowrie's own catalogue (src/cowrie/core/eventids.py, docs/OUTPUT.rst) and logtypes against opencanary/logger.py.
| Check | Before | Now |
|---|---|---|
| Artifact path | Cowrie's storage path (outfile) shown as the file the attacker wrote | destfile as the attacker path, outfile kept as storage |
| Failed downloads | Dropped, so the URL was lost | Kept as a reference marked failed |
| OpenCanary daemon records (logtypes 1000 to 1006) | Counted as events with port -1 and no source | Marked sensor records and left out of counts |
| OpenCanary time | Fell back to local_time_adjusted, the sensor's local clock, read as UTC | utc_time, then local_time (both UTC in logger.py); local time alone is never read as UTC |
| Logtype names | Numbers only | Names from logger.py, for example 4002 SSH_LOGIN_ATTEMPT |
| Cowrie epoch timestamps, T-Pot exports | Not read | epoch (ms) and Elasticsearch _source and hits.hits from T-Pot, with its dest_port rename |
T-Pot ships Cowrie into Elasticsearch through its own Logstash config; this page reads those exports but does not replace T-Pot's dashboards, geolocation or fleet view. Credentials are dropped from both formats, including OpenCanary ARGS on Redis AUTH. Known limits: no other T-Pot honeypots (Dionaea, Suricata and others), no Cowrie tty replay, and OpenCanary portscan records were not generated in the test run.
Counting rules & limitations
Events are input records after your filters. Sessions use sensor + Cowrie session ID; OpenCanary alerts without IDs stay ungrouped. Engaged sessions are behaviour observations, and a log span cannot establish uptime.
Artifact hashes and URLs are reported by the sensor and never fetched. Data stays in this tab; export before leaving.
Cowrie event specification · OpenCanary logging configuration