Containerised SSH honeypot and attack analysis

Cowrie fills a disk with JSON on its own. A directory of JSON is a pile of evidence nobody can question. The work is everything that happens after the log line: giving the events a vocabulary, deciding what an alert means, and being precise about the difference between what was observed and what it implies.

So the problem was not collect attacker activity. It was turn attacker activity into something you can ask questions of, without overstating what you know. Most of the design decisions on this sheet are that second clause doing its work.