{"id":227,"date":"2023-07-29T12:49:01","date_gmt":"2023-07-29T19:49:01","guid":{"rendered":"https:\/\/francisco.x10.bz\/blog\/?p=227"},"modified":"2025-01-13T09:43:34","modified_gmt":"2025-01-13T17:43:34","slug":"understanding-the-cowrie-feed","status":"publish","type":"post","link":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/","title":{"rendered":"Understanding the Cowrie Feed"},"content":{"rendered":"<p>As I mentioned in a <a href=\"\/blog\/index.php\/2023\/07\/22\/installing-and-configuring-a-honeypot\" title=\"Laying Out the Honey: Installing and Configuring a Honeypot\">previous blog<\/a>, Cowrie is a fantastic, easy-to-use honeypot. It captures useful information on port scans and brute-force attempts over SSH and Telnet. This information is provided as an event-based feed. The entries &#8211;basically, sets of fields&#8211; in the feed are not normalized. This means that entries capture different information, based on the event they record.<\/p>\n<h2>Cowrie Events<\/h2>\n<p>This is the list of Cowrie event types:<\/p>\n<table>\n<thead>\n<tr>\n<th>Event<\/th>\n<th>Description<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>cowrie.client.fingerprint<\/td>\n<td>Attributes of an SSH public key used in the attack<\/td>\n<\/tr>\n<tr>\n<td>cowrie.client.kex<\/td>\n<td>Attributes of the SSH key exchange<\/td>\n<\/tr>\n<tr>\n<td>cowrie.client.size<\/td>\n<td>Width and height of the client window<\/td>\n<\/tr>\n<tr>\n<td>cowrie.client.var<\/td>\n<td>Environment variables in the client environment with their corresponding values<\/td>\n<\/tr>\n<tr>\n<td>cowrie.client.version<\/td>\n<td>Version and identification string of the SSH client<\/td>\n<\/tr>\n<tr>\n<td>cowrie.command.failed<\/td>\n<td>Commands entered by the attacker that were not emulated by the honeypot<\/td>\n<\/tr>\n<tr>\n<td>cowrie.command.input<\/td>\n<td>Commands entered by the attacker<\/td>\n<\/tr>\n<tr>\n<td>cowrie.command.success<\/td>\n<td>Commands entered by the attacker that were emulated by the honeypot<\/td>\n<\/tr>\n<tr>\n<td>cowrie.direct-tcpip.data<\/td>\n<td>Data attempted to be sent through direct TCP\/IP forwarding<\/td>\n<\/tr>\n<tr>\n<td>cowrie.direct-tcpip.request<\/td>\n<td>Request for proxying via the honeypot<\/td>\n<\/tr>\n<tr>\n<td>cowrie.log.closed<\/td>\n<td>Recording of a TTYlog session ended<\/td>\n<\/tr>\n<tr>\n<td>cowrie.login.failed<\/td>\n<td>A login attempt failed to authenticate<\/td>\n<\/tr>\n<tr>\n<td>cowrie.login.success<\/td>\n<td>A login attempt successfully authenticated<\/td>\n<\/tr>\n<tr>\n<td>cowrie.session.closed<\/td>\n<td>A session is terminated by either the external entity or the honeypot (timeout)<\/td>\n<\/tr>\n<tr>\n<td>cowrie.session.connect<\/td>\n<td>An external entity (scanner, attacker) starts an connection with the honeypot<\/td>\n<\/tr>\n<tr>\n<td>cowrie.session.file_download<\/td>\n<td>File uploaded to the honeypot with commands like <code>curl<\/code><\/td>\n<\/tr>\n<tr>\n<td>cowrie.session.file_download.failed<\/td>\n<td>File that failed to upload to the honeypot<\/td>\n<\/tr>\n<tr>\n<td>cowrie.session.file_upload<\/td>\n<td>File uploaded to the honeypot with commands like <code>sftp<\/code> or <code>scp<\/code><\/td>\n<\/tr>\n<tr>\n<td>cowrie.session.params<\/td>\n<td>Details of the emulated architecture (e.g., linux-x64-lsb)<\/td>\n<\/tr>\n<tr>\n<td>cowrie.virustotal.scanfile<\/td>\n<td>SHA-256 hash of a file sent to VirusTotal for scanning<\/td>\n<\/tr>\n<tr>\n<td>cowrie.virustotal.scanurl<\/td>\n<td>URL of a file sent to VirusTotal for scanning<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Cowrie Fields<\/h2>\n<p>Each event type is made of a number of fields. Although a few fields &#8211;identified with an asterisk in the table below&#8211; are common to all events, most fields are event-specific:<\/p>\n<table>\n<thead>\n<tr>\n<th>Field<\/th>\n<th>Description<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>arch<\/td>\n<td>Emulated architecture (e.g., <code>linux-x64-lsb<\/code>)<\/td>\n<\/tr>\n<tr>\n<td>compCS<\/td>\n<td>Client-&gt;server compression algorithms in the SSH key exchange<\/td>\n<\/tr>\n<tr>\n<td>data<\/td>\n<td>Data attempted to be sent through direct TCP\/IP forwarding<\/td>\n<\/tr>\n<tr>\n<td>dst_ip<\/td>\n<td>IP address of the honeypot<\/td>\n<\/tr>\n<tr>\n<td>dst_port<\/td>\n<td>Targeted port on the honeypot<\/td>\n<\/tr>\n<tr>\n<td>duplicate<\/td>\n<td><code>true<\/code> if a TTYlog file was reused, <code>false<\/code> otherwise<\/td>\n<\/tr>\n<tr>\n<td>duration<\/td>\n<td>Length of the connection in seconds<\/td>\n<\/tr>\n<tr>\n<td>encCS<\/td>\n<td>Client-&gt;server encryption algorithms in the SSH key exchange<\/td>\n<\/tr>\n<tr>\n<td>filename<\/td>\n<td>Name of a file uploaded to the honeypot<\/td>\n<\/tr>\n<tr>\n<td>fingerprint<\/td>\n<td>Fingerprint of an SSH public key used in the attack<\/td>\n<\/tr>\n<tr>\n<td>hassh<\/td>\n<td>MD5 hash of <code>hasshAlgorithms<\/code>, part of the HASSH network fingerprinting standard used to identify specific SSH implementations<\/td>\n<\/tr>\n<tr>\n<td>hasshAlgorithms<\/td>\n<td>Concatenation of the client-&gt;server algorithms in the SSH key exchange<\/td>\n<\/tr>\n<tr>\n<td>height<\/td>\n<td>Height of the windows client used to connect to the honeypot<\/td>\n<\/tr>\n<tr>\n<td>id<\/td>\n<td>Unique identifier within a session of an attempt to send data through direct TCP\/IP forwarding<\/td>\n<\/tr>\n<tr>\n<td>input<\/td>\n<td>Sequence of one or more Linux command attempted by the attacker on the remote shell<\/td>\n<\/tr>\n<tr>\n<td>is_new<\/td>\n<td><code>true<\/code> if the file or URL submitted to VirusTotal is new (first time), <code>false<\/code> otherwise<\/td>\n<\/tr>\n<tr>\n<td>kexAlgs<\/td>\n<td>SSH key exchange algorithms<\/td>\n<\/tr>\n<tr>\n<td>keyAlgs<\/td>\n<td>Host key algorithms used by the SSH server<\/td>\n<\/tr>\n<tr>\n<td>key<\/td>\n<td>Content of an SSH public key used in the attack<\/td>\n<\/tr>\n<tr>\n<td>langCS<\/td>\n<td>Client-&gt;server language algorithms in the SSH key exchange<\/td>\n<\/tr>\n<tr>\n<td>macCS<\/td>\n<td>Client-&gt;server MAC algorithms in the SSH key exchange<\/td>\n<\/tr>\n<tr>\n<td>message*<\/td>\n<td>Human readable message summarizing the information in the event<\/td>\n<\/tr>\n<tr>\n<td>name<\/td>\n<td>Name of a variable (e.g., <code>LANG<\/code>, <code>LC_ALL<\/code>) in the client environment<\/td>\n<\/tr>\n<tr>\n<td>outfile<\/td>\n<td>Path in the Cowrie environment to file that was uploaded\/downloaded to the honeypot<\/td>\n<\/tr>\n<tr>\n<td>password<\/td>\n<td>Username used in attempt to log into honeypot<\/td>\n<\/tr>\n<tr>\n<td>positives<\/td>\n<td>Number of VirusTotal feed providers that reported a submitted sample as a positive (i.e., suspect or malicious)<\/td>\n<\/tr>\n<tr>\n<td>protocol<\/td>\n<td>In our configuration, either <code>ssh<\/code> or <code>telnet<\/code><\/td>\n<\/tr>\n<tr>\n<td>scan_date<\/td>\n<td>Time of a VirusTotal scan in ISO-8601 format<\/td>\n<\/tr>\n<tr>\n<td>scans.<code>vendor<\/code>.detected<\/td>\n<td><code>true<\/code> if VirusTotal feed provider <code>vendor<\/code> has information on the submitted sample, <code>false<\/code> otherwise<\/td>\n<\/tr>\n<tr>\n<td>scans.<code>vendor<\/code>.result<\/td>\n<td>Result provided by VirusTotal feed provider <code>vendor<\/code> on the submitted sample<\/td>\n<\/tr>\n<tr>\n<td>sensor*<\/td>\n<td>Name of the system hosting the honeypot<\/td>\n<\/tr>\n<tr>\n<td>session*<\/td>\n<td>Unique session identifier<\/td>\n<\/tr>\n<tr>\n<td>sha256<\/td>\n<td>SHA-256 hash of a file submitted to VirusTotal for scanning<\/td>\n<\/tr>\n<tr>\n<td>shasum<\/td>\n<td>SHA-256 hash of a file uploaded\/downloaded to the honeypot<\/td>\n<\/tr>\n<tr>\n<td>size<\/td>\n<td>Size in bytes of the TTYlog file that captured the sequence of commands in an attack<\/td>\n<\/tr>\n<tr>\n<td>src_ip*<\/td>\n<td>IP address of the external entity (scanner or attacker) interacting with the honeypot<\/td>\n<\/tr>\n<tr>\n<td>src_port<\/td>\n<td>Port of the external entity interacting with the honeypot<\/td>\n<\/tr>\n<tr>\n<td>system*<\/td>\n<td>String containing the protocol, source IP address, and source port<\/td>\n<\/tr>\n<tr>\n<td>timestamp*<\/td>\n<td>Timestamp of the event in ISO-8601 format<\/td>\n<\/tr>\n<tr>\n<td>total<\/td>\n<td>Number of VirusTotal feed providers that reported data on a submitted sample<\/td>\n<\/tr>\n<tr>\n<td>ttylog<\/td>\n<td>Path in the Cowrie environment to a TTYlog file that captured the sequence of commands in an attack<\/td>\n<\/tr>\n<tr>\n<td>type<\/td>\n<td>Type of an SSH public key used in the attack; e.g., <code>ssh-rsa<\/code><\/td>\n<\/tr>\n<tr>\n<td>url<\/td>\n<td>URL of a file downloaded to the honeypot or submitted to VirusTotal for scanning<\/td>\n<\/tr>\n<tr>\n<td>username<\/td>\n<td>Username used in attempt to log into honeypot<\/td>\n<\/tr>\n<tr>\n<td>value<\/td>\n<td>Value of a variable (e.g., <code>en_US.UTF-8<\/code>, <code>C.UTF-8<\/code>) in the client environment<\/td>\n<\/tr>\n<tr>\n<td>version<\/td>\n<td>Version and identification string of the SSH client; e.g., <code>SSH-2.0-OpenSSH_9.3<\/code><\/td>\n<\/tr>\n<tr>\n<td>width<\/td>\n<td>Width of the windows client used to connect to the honeypot<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Appendix I: Event-to-Field Mapping<\/h2>\n<table>\n<thead>\n<tr>\n<th>Event<\/th>\n<th>Fields<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>cowrie.client.fingerprint<\/td>\n<td>fingerprint<br \/>key<br \/>message*<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>system*<br \/>timestamp*<br \/>type<br \/>username<\/td>\n<\/tr>\n<tr>\n<td>cowrie.client.kex<\/td>\n<td>compCS<br \/>encCS<br \/>hassh<br \/>hasshAlgorithms<br \/>kexAlgs<br \/>keyAlgs<br \/>langCS<br \/>macCS<br \/>message*<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>system*<br \/>timestamp*<\/td>\n<\/tr>\n<tr>\n<td>cowrie.client.size<\/td>\n<td>height<br \/>message*<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>system*<br \/>timestamp*<br \/>width<\/td>\n<\/tr>\n<tr>\n<td>cowrie.client.var<\/td>\n<td>message*<br \/>name<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>system*<br \/>timestamp*<br \/>value<\/td>\n<\/tr>\n<tr>\n<td>cowrie.client.version<\/td>\n<td>message*<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>system*<br \/>timestamp*<br \/>version<\/td>\n<\/tr>\n<tr>\n<td>cowrie.command.failed<\/td>\n<td>input<br \/>message*<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>system*<br \/>timestamp*<\/td>\n<\/tr>\n<tr>\n<td>cowrie.command.input<\/td>\n<td>input<br \/>message*<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>system*<br \/>timestamp*<\/td>\n<\/tr>\n<tr>\n<td>cowrie.command.success<\/td>\n<td>input<br \/>message*<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>system*<br \/>timestamp*<\/td>\n<\/tr>\n<tr>\n<td>cowrie.direct-tcpip.data<\/td>\n<td>data<br \/>dst_ip<br \/>dst_port<br \/>id<br \/>message*<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>system*<br \/>timestamp*<\/td>\n<\/tr>\n<tr>\n<td>cowrie.direct-tcpip.request<\/td>\n<td>dst_ip<br \/>dst_port<br \/>message*<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>src_port<br \/>system*<br \/>timestamp*<\/td>\n<\/tr>\n<tr>\n<td>cowrie.log.closed<\/td>\n<td>duplicate<br \/>duration<br \/>message*<br \/>sensor*<br \/>session*<br \/>shasum<br \/>size<br \/>src_ip*<br \/>system*<br \/>timestamp*<br \/>ttylog<\/td>\n<\/tr>\n<tr>\n<td>cowrie.login.failed<\/td>\n<td>message*<br \/>password<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>system*<br \/>timestamp*<br \/>username<\/td>\n<\/tr>\n<tr>\n<td>cowrie.login.success<\/td>\n<td>message*<br \/>password<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>system*<br \/>timestamp*<br \/>username<\/td>\n<\/tr>\n<tr>\n<td>cowrie.session.connect<\/td>\n<td>dst_ip<br \/>dst_port<br \/>message*<br \/>protocol<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>src_port<br \/>system*<br \/>timestamp*<\/td>\n<\/tr>\n<tr>\n<td>cowrie.session.closed<\/td>\n<td>duplicate<br \/>duration&gt;duration<br \/>message*<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>system*<br \/>timestamp*<\/td>\n<\/tr>\n<tr>\n<td>cowrie.session.file_download<\/td>\n<td>message*<br \/>outfile<br \/>sensor*<br \/>session*<br \/>shasum<br \/>src_ip*<br \/>system*<br \/>timestamp*<br \/>url<\/td>\n<\/tr>\n<tr>\n<td>cowrie.session.file_download.failed<\/td>\n<td>message*<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>system*<br \/>timestamp*<br \/>url<\/td>\n<\/tr>\n<tr>\n<td>cowrie.session.file_upload<\/td>\n<td>filename<br \/>message*<br \/>outfile<br \/>sensor*<br \/>session*<br \/>shasum<br \/>src_ip*<br \/>system*<br \/>timestamp*<\/td>\n<\/tr>\n<tr>\n<td>cowrie.session.params<\/td>\n<td>arch<br \/>message*<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>system*<br \/>timestamp*<\/td>\n<\/tr>\n<tr>\n<td>cowrie.virustotal.scanfile<\/td>\n<td>is_new<br \/>message*<br \/>positives<br \/>scan_date<br \/>scans.<code>vendor<\/code>.detected<br \/>scans.<code>vendor<\/code>.result<br \/>sensor*<br \/>session*<br \/>sha256<br \/>src_ip*<br \/>system*<br \/>timestamp*<br \/>total<\/td>\n<\/tr>\n<tr>\n<td>cowrie.virustotal.scanurl<\/td>\n<td>is_new<br \/>message*<br \/>positives<br \/>scan_date<br \/>scans.<code>vendor<\/code>.detected<br \/>scans.<code>vendor<\/code>.result<br \/>sensor*<br \/>session*<br \/>src_ip*<br \/>system*<br \/>timestamp*<br \/>total<br \/>url<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Appendix II: Field-to-Event Mapping<\/h2>\n<table>\n<thead>\n<tr>\n<th>Field<\/th>\n<th>Present in Event(s)<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>arch<\/td>\n<td>cowrie.session.params<\/td>\n<\/tr>\n<tr>\n<td>compCS<\/td>\n<td>cowrie.client.kex<\/td>\n<\/tr>\n<tr>\n<td>data<\/td>\n<td>cowrie.direct-tcpip.data<\/td>\n<\/tr>\n<tr>\n<td>dst_ip<\/td>\n<td>cowrie.session.connect<br \/>cowrie.direct-tcpip.request<br \/>cowrie.direct-tcpip.data<\/td>\n<\/tr>\n<tr>\n<td>dst_port<\/td>\n<td>cowrie.session.connect<br \/>cowrie.direct-tcpip.request<br \/>cowrie.direct-tcpip.data<\/td>\n<\/tr>\n<tr>\n<td>duplicate<\/td>\n<td>cowrie.session.closed<br \/>cowrie.log.closed<\/td>\n<\/tr>\n<tr>\n<td>duration<\/td>\n<td>cowrie.session.closed<br \/>cowrie.log.closed<\/td>\n<\/tr>\n<tr>\n<td>encCS<\/td>\n<td>cowrie.client.kex<\/td>\n<\/tr>\n<tr>\n<td>filename<\/td>\n<td>cowrie.session.file_upload<\/td>\n<\/tr>\n<tr>\n<td>fingerprint<\/td>\n<td>cowrie.client.fingerprint<\/td>\n<\/tr>\n<tr>\n<td>hassh<\/td>\n<td>cowrie.client.kex<\/td>\n<\/tr>\n<tr>\n<td>hasshAlgorithms<\/td>\n<td>cowrie.client.kex<\/td>\n<\/tr>\n<tr>\n<td>height<\/td>\n<td>cowrie.client.size<\/td>\n<\/tr>\n<tr>\n<td>id<\/td>\n<td>cowrie.direct-tcpip.data<\/td>\n<\/tr>\n<tr>\n<td>input<\/td>\n<td>cowrie.command.input<br \/>cowrie.command.failed<br \/>cowrie.command.success<\/td>\n<\/tr>\n<tr>\n<td>is_new<\/td>\n<td>cowrie.virustotal.scanfile<br \/>cowrie.virustotal.scanurl<\/td>\n<\/tr>\n<tr>\n<td>kexAlgs<\/td>\n<td>cowrie.client.kex<\/td>\n<\/tr>\n<tr>\n<td>keyAlgs<\/td>\n<td>cowrie.client.kex<\/td>\n<\/tr>\n<tr>\n<td>key<\/td>\n<td>cowrie.client.fingerprint<\/td>\n<\/tr>\n<tr>\n<td>langCS<\/td>\n<td>cowrie.client.kex<\/td>\n<\/tr>\n<tr>\n<td>macCS<\/td>\n<td>cowrie.client.kex<\/td>\n<\/tr>\n<tr>\n<td>message*<\/td>\n<td>cowrie.client.fingerprint<br \/>cowrie.client.kex<br \/>cowrie.client.size<br \/>cowrie.client.var<br \/>cowrie.client.version<br \/>cowrie.command.failed<br \/>cowrie.command.input<br \/>cowrie.command.success<br \/>cowrie.direct-tcpip.data<br \/>cowrie.direct-tcpip.request<br \/>cowrie.log.closed<br \/>cowrie.login.failed<br \/>cowrie.login.success<br \/>cowrie.session.closed<br \/>cowrie.session.connect<br \/>cowrie.session.file_download<br \/>cowrie.session.file_download.failed<br \/>cowrie.session.file_upload<br \/>cowrie.session.params<br \/>cowrie.virustotal.scanfile<br \/>cowrie.virustotal.scanurl<\/td>\n<\/tr>\n<tr>\n<td>name<\/td>\n<td>cowrie.client.var<\/td>\n<\/tr>\n<tr>\n<td>outfile<\/td>\n<td>cowrie.session.file_download<br \/>cowrie.session.file_upload<\/td>\n<\/tr>\n<tr>\n<td>password<\/td>\n<td>cowrie.login.failed<br \/>cowrie.login.success<\/td>\n<\/tr>\n<tr>\n<td>positives<\/td>\n<td>cowrie.virustotal.scanfile<br \/>cowrie.virustotal.scanurl<\/td>\n<\/tr>\n<tr>\n<td>protocol<\/td>\n<td>cowrie.session.connect<\/td>\n<\/tr>\n<tr>\n<td>scan_date<\/td>\n<td>cowrie.virustotal.scanfile<br \/>cowrie.virustotal.scanurl<\/td>\n<\/tr>\n<tr>\n<td>scans.<code>vendor<\/code>.detected<\/td>\n<td>cowrie.virustotal.scanfile<br \/>cowrie.virustotal.scanurl<\/td>\n<\/tr>\n<tr>\n<td>scans.<code>vendor<\/code>.result<\/td>\n<td>cowrie.virustotal.scanfile<br \/>cowrie.virustotal.scanurl<\/td>\n<\/tr>\n<tr>\n<td>sensor*<\/td>\n<td>cowrie.client.fingerprint<br \/>cowrie.client.kex<br \/>cowrie.client.size<br \/>cowrie.client.var<br \/>cowrie.client.version<br \/>cowrie.command.failed<br \/>cowrie.command.input<br \/>cowrie.command.success<br \/>cowrie.direct-tcpip.data<br \/>cowrie.direct-tcpip.request<br \/>cowrie.log.closed<br \/>cowrie.login.failed<br \/>cowrie.login.success<br \/>cowrie.session.closed<br \/>cowrie.session.connect<br \/>cowrie.session.file_download<br \/>cowrie.session.file_download.failed<br \/>cowrie.session.file_upload<br \/>cowrie.session.params<br \/>cowrie.virustotal.scanfile<br \/>cowrie.virustotal.scanurl<\/td>\n<\/tr>\n<tr>\n<td>session*<\/td>\n<td>cowrie.client.fingerprint<br \/>cowrie.client.kex<br \/>cowrie.client.size<br \/>cowrie.client.var<br \/>cowrie.client.version<br \/>cowrie.command.failed<br \/>cowrie.command.input<br \/>cowrie.command.success<br \/>cowrie.direct-tcpip.data<br \/>cowrie.direct-tcpip.request<br \/>cowrie.log.closed<br \/>cowrie.login.failed<br \/>cowrie.login.success<br \/>cowrie.session.closed<br \/>cowrie.session.connect<br \/>cowrie.session.file_download<br \/>cowrie.session.file_download.failed<br \/>cowrie.session.file_upload<br \/>cowrie.session.params<br \/>cowrie.virustotal.scanfile<br \/>cowrie.virustotal.scanurl<\/td>\n<\/tr>\n<tr>\n<td>sha256<\/td>\n<td>cowrie.virustotal.scanfile<\/td>\n<\/tr>\n<tr>\n<td>shasum<\/td>\n<td>cowrie.session.file_download<br \/>cowrie.session.file_upload<br \/>cowrie.log.closed<\/td>\n<\/tr>\n<tr>\n<td>size<\/td>\n<td>cowrie.log.closed<\/td>\n<\/tr>\n<tr>\n<td>src_ip*<\/td>\n<td>cowrie.client.fingerprint<br \/>cowrie.client.kex<br \/>cowrie.client.size<br \/>cowrie.client.var<br \/>cowrie.client.version<br \/>cowrie.command.failed<br \/>cowrie.command.input<br \/>cowrie.command.success<br \/>cowrie.direct-tcpip.data<br \/>cowrie.direct-tcpip.request<br \/>cowrie.log.closed<br \/>cowrie.login.failed<br \/>cowrie.login.success<br \/>cowrie.session.closed<br \/>cowrie.session.connect<br \/>cowrie.session.file_download<br \/>cowrie.session.file_download.failed<br \/>cowrie.session.file_upload<br \/>cowrie.session.params<br \/>cowrie.virustotal.scanfile<br \/>cowrie.virustotal.scanurl<\/td>\n<\/tr>\n<tr>\n<td>src_port<\/td>\n<td>cowrie.session.connect<br \/>cowrie.direct-tcpip.request<\/td>\n<\/tr>\n<tr>\n<td>system*<\/td>\n<td>cowrie.client.fingerprint<br \/>cowrie.client.kex<br \/>cowrie.client.size<br \/>cowrie.client.var<br \/>cowrie.client.version<br \/>cowrie.command.failed<br \/>cowrie.command.input<br \/>cowrie.command.success<br \/>cowrie.direct-tcpip.data<br \/>cowrie.direct-tcpip.request<br \/>cowrie.log.closed<br \/>cowrie.login.failed<br \/>cowrie.login.success<br \/>cowrie.session.closed<br \/>cowrie.session.connect<br \/>cowrie.session.file_download<br \/>cowrie.session.file_download.failed<br \/>cowrie.session.file_upload<br \/>cowrie.session.params<br \/>cowrie.virustotal.scanfile<br \/>cowrie.virustotal.scanurl<\/td>\n<\/tr>\n<tr>\n<td>timestamp*<\/td>\n<td>cowrie.client.fingerprint<br \/>cowrie.client.kex<br \/>cowrie.client.size<br \/>cowrie.client.var<br \/>cowrie.client.version<br \/>cowrie.command.failed<br \/>cowrie.command.input<br \/>cowrie.command.success<br \/>cowrie.direct-tcpip.data<br \/>cowrie.direct-tcpip.request<br \/>cowrie.log.closed<br \/>cowrie.login.failed<br \/>cowrie.login.success<br \/>cowrie.session.closed<br \/>cowrie.session.connect<br \/>cowrie.session.file_download<br \/>cowrie.session.file_download.failed<br \/>cowrie.session.file_upload<br \/>cowrie.session.params<br \/>cowrie.virustotal.scanfile<br \/>cowrie.virustotal.scanurl<\/td>\n<\/tr>\n<tr>\n<td>total<\/td>\n<td>cowrie.virustotal.scanfile<br \/>cowrie.virustotal.scanurl<\/td>\n<\/tr>\n<tr>\n<td>ttylog<\/td>\n<td>cowrie.log.closed<\/td>\n<\/tr>\n<tr>\n<td>type<\/td>\n<td>cowrie.client.fingerprint<\/td>\n<\/tr>\n<tr>\n<td>url<\/td>\n<td>cowrie.virustotal.scanurl<br \/>cowrie.session.file_download<br \/>cowrie.session.file_download.failed<\/td>\n<\/tr>\n<tr>\n<td>username<\/td>\n<td>cowrie.login.failed<br \/>cowrie.login.success<br \/>cowrie.client.fingerprint<\/td>\n<\/tr>\n<tr>\n<td>value<\/td>\n<td>cowrie.client.var<\/td>\n<\/tr>\n<tr>\n<td>version<\/td>\n<td>cowrie.client.version<\/td>\n<\/tr>\n<tr>\n<td>width<\/td>\n<td>cowrie.client.size<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"<p>As I mentioned in a previous blog, Cowrie is a fantastic, easy-to-use honeypot. It captures useful information on port scans and brute-force attempts over SSH and Telnet. This information is provided as an event-based feed. The entries &#8211;basically, sets of fields&#8211; in the feed are not normalized. This means that entries capture different information, based [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-227","post","type-post","status-publish","format-standard","hentry","category-cyber"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"As I mentioned in a previous blog, Cowrie is a fantastic, easy-to-use honeypot. It captures useful information on port scans and brute-force attempts over SSH and Telnet. This information is provided as an event-based feed. The entries --basically, sets of fields-- in the feed are not normalized. This means that entries capture different information, based\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Rufo De Francisco\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"A Pot of Honey - Cybersecurity insights from a honeypot operator.\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Understanding the Cowrie Feed - A Pot of Honey\" \/>\n\t\t<meta property=\"og:description\" content=\"As I mentioned in a previous blog, Cowrie is a fantastic, easy-to-use honeypot. It captures useful information on port scans and brute-force attempts over SSH and Telnet. This information is provided as an event-based feed. The entries --basically, sets of fields-- in the feed are not normalized. This means that entries capture different information, based\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-07-29T19:49:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2025-01-13T17:43:34+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@rjdefrancisco\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Understanding the Cowrie Feed - A Pot of Honey\" \/>\n\t\t<meta name=\"twitter:description\" content=\"As I mentioned in a previous blog, Cowrie is a fantastic, easy-to-use honeypot. It captures useful information on port scans and brute-force attempts over SSH and Telnet. This information is provided as an event-based feed. The entries --basically, sets of fields-- in the feed are not normalized. This means that entries capture different information, based\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@rjdefrancisco\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/2023\\\/07\\\/29\\\/understanding-the-cowrie-feed\\\/#blogposting\",\"name\":\"Understanding the Cowrie Feed - A Pot of Honey\",\"headline\":\"Understanding the Cowrie Feed\",\"author\":{\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/author\\\/rjdefrancisco\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/#person\"},\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/2023\\\/07\\\/29\\\/understanding-the-cowrie-feed\\\/#articleImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/93022ba0aad01624e397f47cb16ba8949884390a8cc795305de2cfa00463ceb6?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Rufo De Francisco\"},\"datePublished\":\"2023-07-29T12:49:01-07:00\",\"dateModified\":\"2025-01-13T09:43:34-08:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/2023\\\/07\\\/29\\\/understanding-the-cowrie-feed\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/2023\\\/07\\\/29\\\/understanding-the-cowrie-feed\\\/#webpage\"},\"articleSection\":\"cyber\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/2023\\\/07\\\/29\\\/understanding-the-cowrie-feed\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/defrancisco.us\\\/blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/category\\\/cyber\\\/#listItem\",\"name\":\"cyber\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/category\\\/cyber\\\/#listItem\",\"position\":2,\"name\":\"cyber\",\"item\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/category\\\/cyber\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/2023\\\/07\\\/29\\\/understanding-the-cowrie-feed\\\/#listItem\",\"name\":\"Understanding the Cowrie Feed\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/2023\\\/07\\\/29\\\/understanding-the-cowrie-feed\\\/#listItem\",\"position\":3,\"name\":\"Understanding the Cowrie Feed\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/category\\\/cyber\\\/#listItem\",\"name\":\"cyber\"}}]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/#person\",\"name\":\"Rufo De Francisco\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/2023\\\/07\\\/29\\\/understanding-the-cowrie-feed\\\/#personImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/93022ba0aad01624e397f47cb16ba8949884390a8cc795305de2cfa00463ceb6?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Rufo De Francisco\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/author\\\/rjdefrancisco\\\/#author\",\"url\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/author\\\/rjdefrancisco\\\/\",\"name\":\"Rufo De Francisco\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/2023\\\/07\\\/29\\\/understanding-the-cowrie-feed\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/93022ba0aad01624e397f47cb16ba8949884390a8cc795305de2cfa00463ceb6?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Rufo De Francisco\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/2023\\\/07\\\/29\\\/understanding-the-cowrie-feed\\\/#webpage\",\"url\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/2023\\\/07\\\/29\\\/understanding-the-cowrie-feed\\\/\",\"name\":\"Understanding the Cowrie Feed - A Pot of Honey\",\"description\":\"As I mentioned in a previous blog, Cowrie is a fantastic, easy-to-use honeypot. It captures useful information on port scans and brute-force attempts over SSH and Telnet. This information is provided as an event-based feed. The entries --basically, sets of fields-- in the feed are not normalized. This means that entries capture different information, based\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/2023\\\/07\\\/29\\\/understanding-the-cowrie-feed\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/author\\\/rjdefrancisco\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/index.php\\\/author\\\/rjdefrancisco\\\/#author\"},\"datePublished\":\"2023-07-29T12:49:01-07:00\",\"dateModified\":\"2025-01-13T09:43:34-08:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/\",\"name\":\"A Pot of Honey\",\"description\":\"Cybersecurity insights from a honeypot operator.\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/defrancisco.us\\\/blog\\\/#person\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Understanding the Cowrie Feed - A Pot of Honey","description":"As I mentioned in a previous blog, Cowrie is a fantastic, easy-to-use honeypot. It captures useful information on port scans and brute-force attempts over SSH and Telnet. This information is provided as an event-based feed. The entries --basically, sets of fields-- in the feed are not normalized. This means that entries capture different information, based","canonical_url":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/#blogposting","name":"Understanding the Cowrie Feed - A Pot of Honey","headline":"Understanding the Cowrie Feed","author":{"@id":"https:\/\/defrancisco.us\/blog\/index.php\/author\/rjdefrancisco\/#author"},"publisher":{"@id":"https:\/\/defrancisco.us\/blog\/#person"},"image":{"@type":"ImageObject","@id":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/#articleImage","url":"https:\/\/secure.gravatar.com\/avatar\/93022ba0aad01624e397f47cb16ba8949884390a8cc795305de2cfa00463ceb6?s=96&d=mm&r=g","width":96,"height":96,"caption":"Rufo De Francisco"},"datePublished":"2023-07-29T12:49:01-07:00","dateModified":"2025-01-13T09:43:34-08:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/#webpage"},"isPartOf":{"@id":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/#webpage"},"articleSection":"cyber"},{"@type":"BreadcrumbList","@id":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/defrancisco.us\/blog#listItem","position":1,"name":"Home","item":"https:\/\/defrancisco.us\/blog","nextItem":{"@type":"ListItem","@id":"https:\/\/defrancisco.us\/blog\/index.php\/category\/cyber\/#listItem","name":"cyber"}},{"@type":"ListItem","@id":"https:\/\/defrancisco.us\/blog\/index.php\/category\/cyber\/#listItem","position":2,"name":"cyber","item":"https:\/\/defrancisco.us\/blog\/index.php\/category\/cyber\/","nextItem":{"@type":"ListItem","@id":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/#listItem","name":"Understanding the Cowrie Feed"},"previousItem":{"@type":"ListItem","@id":"https:\/\/defrancisco.us\/blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/#listItem","position":3,"name":"Understanding the Cowrie Feed","previousItem":{"@type":"ListItem","@id":"https:\/\/defrancisco.us\/blog\/index.php\/category\/cyber\/#listItem","name":"cyber"}}]},{"@type":"Person","@id":"https:\/\/defrancisco.us\/blog\/#person","name":"Rufo De Francisco","image":{"@type":"ImageObject","@id":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/#personImage","url":"https:\/\/secure.gravatar.com\/avatar\/93022ba0aad01624e397f47cb16ba8949884390a8cc795305de2cfa00463ceb6?s=96&d=mm&r=g","width":96,"height":96,"caption":"Rufo De Francisco"}},{"@type":"Person","@id":"https:\/\/defrancisco.us\/blog\/index.php\/author\/rjdefrancisco\/#author","url":"https:\/\/defrancisco.us\/blog\/index.php\/author\/rjdefrancisco\/","name":"Rufo De Francisco","image":{"@type":"ImageObject","@id":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/93022ba0aad01624e397f47cb16ba8949884390a8cc795305de2cfa00463ceb6?s=96&d=mm&r=g","width":96,"height":96,"caption":"Rufo De Francisco"}},{"@type":"WebPage","@id":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/#webpage","url":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/","name":"Understanding the Cowrie Feed - A Pot of Honey","description":"As I mentioned in a previous blog, Cowrie is a fantastic, easy-to-use honeypot. It captures useful information on port scans and brute-force attempts over SSH and Telnet. This information is provided as an event-based feed. The entries --basically, sets of fields-- in the feed are not normalized. This means that entries capture different information, based","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/defrancisco.us\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/#breadcrumblist"},"author":{"@id":"https:\/\/defrancisco.us\/blog\/index.php\/author\/rjdefrancisco\/#author"},"creator":{"@id":"https:\/\/defrancisco.us\/blog\/index.php\/author\/rjdefrancisco\/#author"},"datePublished":"2023-07-29T12:49:01-07:00","dateModified":"2025-01-13T09:43:34-08:00"},{"@type":"WebSite","@id":"https:\/\/defrancisco.us\/blog\/#website","url":"https:\/\/defrancisco.us\/blog\/","name":"A Pot of Honey","description":"Cybersecurity insights from a honeypot operator.","inLanguage":"en-US","publisher":{"@id":"https:\/\/defrancisco.us\/blog\/#person"}}]},"og:locale":"en_US","og:site_name":"A Pot of Honey - Cybersecurity insights from a honeypot operator.","og:type":"article","og:title":"Understanding the Cowrie Feed - A Pot of Honey","og:description":"As I mentioned in a previous blog, Cowrie is a fantastic, easy-to-use honeypot. It captures useful information on port scans and brute-force attempts over SSH and Telnet. This information is provided as an event-based feed. The entries --basically, sets of fields-- in the feed are not normalized. This means that entries capture different information, based","og:url":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/","article:published_time":"2023-07-29T19:49:01+00:00","article:modified_time":"2025-01-13T17:43:34+00:00","twitter:card":"summary_large_image","twitter:site":"@rjdefrancisco","twitter:title":"Understanding the Cowrie Feed - A Pot of Honey","twitter:description":"As I mentioned in a previous blog, Cowrie is a fantastic, easy-to-use honeypot. It captures useful information on port scans and brute-force attempts over SSH and Telnet. This information is provided as an event-based feed. The entries --basically, sets of fields-- in the feed are not normalized. This means that entries capture different information, based","twitter:creator":"@rjdefrancisco"},"aioseo_meta_data":{"post_id":"227","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"limit_modified_date":false,"created":"2024-03-17 23:57:10","updated":"2026-06-25 06:16:27","ai":null,"breadcrumb_settings":null,"seo_analyzer_scan_date":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/defrancisco.us\/blog\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/defrancisco.us\/blog\/index.php\/category\/cyber\/\" title=\"cyber\">cyber<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">&raquo;<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tUnderstanding the Cowrie Feed\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/defrancisco.us\/blog"},{"label":"cyber","link":"https:\/\/defrancisco.us\/blog\/index.php\/category\/cyber\/"},{"label":"Understanding the Cowrie Feed","link":"https:\/\/defrancisco.us\/blog\/index.php\/2023\/07\/29\/understanding-the-cowrie-feed\/"}],"_links":{"self":[{"href":"https:\/\/defrancisco.us\/blog\/index.php\/wp-json\/wp\/v2\/posts\/227","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/defrancisco.us\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/defrancisco.us\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/defrancisco.us\/blog\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/defrancisco.us\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=227"}],"version-history":[{"count":1,"href":"https:\/\/defrancisco.us\/blog\/index.php\/wp-json\/wp\/v2\/posts\/227\/revisions"}],"predecessor-version":[{"id":228,"href":"https:\/\/defrancisco.us\/blog\/index.php\/wp-json\/wp\/v2\/posts\/227\/revisions\/228"}],"wp:attachment":[{"href":"https:\/\/defrancisco.us\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=227"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/defrancisco.us\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=227"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/defrancisco.us\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=227"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}