Cowrie vs TANNER

Cowrie is a free, open-source SSH and Telnet honeypot for recording brute-force attempts and activity in attackers’ shell sessions. Its default mode imitates a UNIX environment in Python using a fake filesystem, so commands do not run on the real host. Proxy mode instead forwards SSH and Telnet sessions to another system while monitoring behavior. Cowrie records terminal sessions with timing information for replay, and saves files fetched with wget or curl as well as uploads through SFTP or SCP. JSON logs can include logins, commands, downloads, TCP forwards and session details. Output plugins connect it to tools and services including Elasticsearch, Splunk, Microsoft Sentinel, MISP, VirusTotal, databases, messaging platforms and monitoring systems. An experimental LLM backend can generate shell responses while keeping session context. Cowrie is self-hosted, with installation options including pip, Docker or a Git checkout; local requirements include Python 3.11+ and python-virtualenv. The BSD-licensed project began in 2014 and is maintained by volunteers.

TANNER has no write-up on Specifiction yet; its figures are above.