A home security lab built around a Cowrie SSH honeypot
A learner's honeypot lab that turns Cowrie logs into daily reports and IP enrichment, with Python tooling partly built with Claude's help.
Credits
Earliest dated source:
The full story
After about a year of learning cybersecurity, the maker built a small home security operations lab around a Cowrie SSH honeypot that collects real scan and login attempts. Python scripts turn its JSON logs into daily Markdown reports and structured evidence, and enrich IP addresses with AbuseIPDB, GreyNoise, Shodan, VirusTotal, WHOIS and GeoIP.
There are written case studies of real scanner activity, mostly in German, plus setup notes. The maker says they are still building confidence with Python and config writing, so parts of the tooling were built with Claude's help, and they are working through the code so they can maintain it themselves.
How it was done
Tools
Themes
Loading themes…
Sources
From a short post by the maker, so the details are as they tell them.
- Reddit: Turning Cowrie SSH honeypot logs into daily reports, IP enrichment and case studiesReddit poster: xln777Posted
The maker's post on r/homelab.
If it disappears: archived copy of Reddit: Turning Cowrie SSH honeypot logs into daily reports, IP enrichment and case studies (opens in a new tab)
- The code: github.comRepository account: xln777
The project on GitHub.