SSH honeypot and attack analysis

Cowrie will happily fill a disk with JSON. A directory of JSON is not a detection capability — it is a pile of evidence nobody can question. The work is everything that happens after the log line: giving the events a vocabulary, deciding what an alert means, and being precise about the difference between what was observed and what it implies.

So the problem was not collect attacker activity. It was turn attacker activity into something you can ask questions of, without overstating what you know. Most of the design decisions on this sheet are that second clause doing its work.