Every event Cowrie records can go to any number of destinations at once. Enable a plugin by setting its section in cowrie.cfg and restarting.
Index every event for search and Kibana dashboards.
[output_elasticsearch] enabled = true
Send events over the HTTP Event Collector.
[output_splunk] enabled = true
Forward the JSON log to a Log Analytics workspace.
[output_jsonlog] enabled = true
Publish downloaded samples and attacker addresses as MISP events.
[output_misp] enabled = true
Share events with a honeypot community feed.
[output_hpfeeds3] enabled = true
Submit each new sample and record the verdict.
[output_virustotal] enabled = true
Post a message for each event to a channel.
[output_slack] enabled = true
Post a message for each event through a webhook.
[output_discord] enabled = true
Store sessions, logins, commands and downloads in tables.
[output_mysql] enabled = true
Store sessions, logins, commands and downloads in tables.
[output_postgresql] enabled = true
Same schema as MySQL, in a single local file.
[output_sqlite] enabled = true
Store raw events as documents.
[output_mongodb] enabled = true
Send events as GELF messages.
[output_graylog] enabled = true
Publish events to a topic for your own pipeline.
[output_kafka] enabled = true
Expose counters for scraping and alerting.
[output_prometheus] enabled = true
Send events to the Datadog logs API.
[output_datadog] enabled = true
Upload downloaded samples to a bucket.
[output_s3] enabled = true
Report attacking addresses automatically.
[output_abuseipdb] enabled = true
Contribute login attempts to the SANS Internet Storm Center.
[output_dshield] enabled = true
Write events to the local syslog daemon.
[output_localsyslog] enabled = true
The default. One JSON object per line, ready for anything else.
[output_jsonlog] enabled = true
Cowrie ships around forty output plugins. The rest, including Redis, InfluxDB, Telegram, GreyNoise, URLhaus, MalShare, XMPP and Cuckoo, are covered in the output plugin documentation.